title: Why does BCrypt.net GenerateSalt(31) return straight away?
body: <p>I stumbled across BCrypt.net after reading <a href="http://www.codinghorror.com/blog/archives/000953.html" rel="nofollow noreferrer">Jeff Atwood's post about storing passwords</a> which led me to Thomas Ptacek's recommendation to <a href="http://chargen.matasano.com/chargen/2007/9/7/enough-with-the-rainbow-tables-what-you-need-to-know-about-s.html" rel="nofollow noreferrer">use BCrypt</a> to store passwords. Which finally led me to <a href="http://derekslager.com/blog/posts/2007/10/bcrypt-dotnet-strong-password-hashing-for-dotnet-and-mono.ashx" rel="nofollow noreferrer">this C# implementation of BCrypt</a></p>
  
  <p>In the comments on the last link above someone asked "Why do GenerateSalt(30) take for ever, but GenerateSalt(31) seems to take no time at all?"</p>
  
  <p>I ran BCrypt.HashPassword(password, BCrypt.GenerateSalt(31)) and got my result in 0 milliseconds.</p>
  
  <p>I've been running BCrypt.HashPassword("password", BCrypt.GenerateSalt(30)) for over 5 minutes now and still do not have a result.</p>
  
  <p>I realize we'll probably not need a randomly generated 30 character salt to create our password hashes (or <a href="https://stackoverflow.com/questions/1561174/sha512-vs-blowfish-and-bcrypt#answer-1561245">irreversible encryption in BCrypt's case</a>) for years. <strong>EDIT</strong> I should have read the code a bit, logRounds doesn't have anything to do with the salt length. Thanks Aaronaught.</p>
  
  <p>So, why does GenerateSalt(31) return a value almost instantly (when it should take about twice as long as GenerateSalt(30)?</p>
  
  <p><strong>UPDATE</strong></p>
  
  <p>here is the fix:</p>
  
  <pre><code>private byte[] CryptRaw(byte[] password, byte[] salt, int logRounds) {
      // ... snip ...
      uint rounds = 1U &lt;&lt; logRounds;
      // ... snip
  }
  </code></pre>