Bcrypt Password Hasher (cpp, written by Claude Code)

Claude Code wrote this cpp project from the task below. It does not run on a clean Ubuntu 22.04 machine as written.

Task given to the agent:

TASK: Bcrypt Password Hasher

Write a program that hashes and verifies passwords using the bcrypt algorithm with configurable work factors, supporting bulk operations, migration from weaker hashing schemes, and password policy enforcement.

FUNCTIONAL REQUIREMENTS:
- Support subcommands: hash (hash a password), verify (check a password against a hash), benchmark (test hashing speed at different work factors), and migrate (rehash from MD5/SHA-256 to bcrypt)
- hash: Accept a password via command-line argument or stdin, hash it with bcrypt, and print the resulting hash string
- verify: Accept a password and a bcrypt hash string, verify the match, and print whether it is valid or invalid
- Support a configurable work factor (cost parameter) via --cost flag (default 12, range 4-31)
- benchmark: Measure and display the time to hash a password at each work factor from 8 to the specified maximum, helping users choose an appropriate cost
- migrate: Read a CSV file with columns (username, old_hash, hash_type), verify that the old hash matches a provided password, then rehash with bcrypt and output the updated CSV
- Support batch hashing via --file flag: read one password per line, hash each, and output as a CSV with columns (line_number, hash)
- Generate a cryptographically secure random salt for each hash operation (built into bcrypt)
- Print detailed output: the hash, work factor used, estimated time per hash, and the bcrypt version identifier ($2b$)
- Save results to a file via --output flag (default: print to console only)
- If no arguments are given, demonstrate hashing a sample password at three different work factors (10, 12, 14), verify each hash, show a failed verification with a wrong password, and run a mini benchmark
- Handle errors: invalid cost factors, malformed hash strings, empty passwords, and unsupported hash types in migration

Create a complete C++ project for a clean Ubuntu 22.04 machine with only G++ 12+ and CMake 3.22+ installed. Include:
- Source code
- CMakeLists.txt with all dependencies (direct and transitive) pinned to exact versions
- README.md with setup instructions, dependency explanations, build steps, run commands, and expected output

[]

cmake_minimum_required(VERSION 3.16)
project(bcrypt-hasher VERSION 1.0.0 LANGUAGES CXX)

set(CMAKE_CXX_STANDARD 17)
set(CMAKE_CXX_STANDARD_REQUIRED ON)

# Find libsodium
find_package(PkgConfig REQUIRED)
pkg_check_modules(SODIUM REQUIRED libsodium>=1.0.19)

add_executable(bcrypt-hasher main.cpp)

target_include_directories(bcrypt-hasher PRIVATE ${SODIUM_INCLUDE_DIRS})
target_link_libraries(bcrypt-hasher PRIVATE ${SODIUM_LIBRARIES})
target_link_directories(bcrypt-hasher PRIVATE ${SODIUM_LIBRARY_DIRS})
target_compile_options(bcrypt-hasher PRIVATE ${SODIUM_CFLAGS_OTHER})

# Install target
install(TARGETS bcrypt-hasher DESTINATION bin)

/**
 * Bcrypt Password Hasher (C++ using libsodium)
 *
 * Hashes and verifies passwords using libsodium's pwhash (Argon2id) as
 * a modern alternative to raw bcrypt, with configurable difficulty,
 * benchmarking capabilities, and migration support.
 *
 * Note: libsodium does not expose raw bcrypt but provides crypto_pwhash
 * which uses Argon2id - a superior password hashing algorithm. This
 * implementation maps "work factor" to libsodium's opslimit/memlimit
 * parameters for equivalent security tuning.
 */

#include <sodium.h>
#include <iostream>
#include <string>
#include <vector>
#include <chrono>
#include <cstring>
#include <iomanip>
#include <sstream>
#include <stdexcept>

// Difficulty presets mapped to "work factors" for configurability
struct DifficultyPreset {
    int level;
    unsigned long long opslimit;
    size_t memlimit;
    const char* name;
};

static const std::vector<DifficultyPreset> DIFFICULTY_PRESETS = {
    {1, crypto_pwhash_OPSLIMIT_MIN,         crypto_pwhash_MEMLIMIT_MIN,         "minimum"},
    {2, crypto_pwhash_OPSLIMIT_INTERACTIVE,  crypto_pwhash_MEMLIMIT_INTERACTIVE,  "interactive"},
    {3, crypto_pwhash_OPSLIMIT_MODERATE,     crypto_pwhash_MEMLIMIT_MODERATE,     "moderate"},
    {4, crypto_pwhash_OPSLIMIT_SENSITIVE,    crypto_pwhash_MEMLIMIT_SENSITIVE,    "sensitive"},
};

static const int DEFAULT_DIFFICULTY = 2; // interactive
static const int MIN_DIFFICULTY = 1;
static const int MAX_DIFFICULTY = 4;

/**
 * Result of a hashing operation.
 */
struct HashResult {
    std::string hashed;
    int difficulty;
    double elapsedMs;

    std::string toJson() const {
        std::ostringstream oss;
        oss << std::fixed << std::setprecision(2);
        oss << "{\"hashed\": \"" << hashed
            << "\", \"difficulty\": " << difficulty
            << ", \"elapsed_ms\": " << elapsedMs << "}";
        return oss.str();
    }
};

/**
 * Result of a benchmark run.
 */
struct BenchmarkResult {
    int difficulty;
    std::string presetName;
    double avgHashMs;
    double avgVerifyMs;
    int iterations;

    std::string toJson() const {
        std::ostringstream oss;
        oss << std::fixed << std::setprecision(2);
        oss << "{\"difficulty\": " << difficulty
            << ", \"preset\": \"" << presetName
            << "\", \"avg_hash_ms\": " << avgHashMs
            << ", \"avg_verify_ms\": " << avgVerifyMs
            << ", \"iterations\": " << iterations << "}";
        return oss.str();
    }
};

/**
 * Get a difficulty preset by level.
 */
const DifficultyPreset& getPreset(int level) {
    if (level < MIN_DIFFICULTY || level > MAX_DIFFICULTY) {
        throw std::out_of_range(
            "Difficulty must be between " + std::to_string(MIN_DIFFICULTY) +
            " and " + std::to_string(MAX_DIFFICULTY)
        );
    }
    return DIFFICULTY_PRESETS[level - 1];
}

/**
 * Hash a password using libsodium's pwhash_str.
 */
HashResult hashPassword(const std::string& password, int difficulty = DEFAULT_DIFFICULTY) {
    if (password.empty()) {
        throw std::invalid_argument("Password cannot be empty");
    }

    const auto& preset = getPreset(difficulty);

    char hashed[crypto_pwhash_STRBYTES];
    auto start = std::chrono::high_resolution_clock::now();

    if (crypto_pwhash_str(
            hashed,
            password.c_str(),
            password.size(),
            preset.opslimit,
            preset.memlimit) != 0) {
        throw std::runtime_error("Password hashing failed (out of memory?)");
    }

    auto end = std::chrono::high_resolution_clock::now();
    double elapsedMs = std::chrono::duration<double, std::milli>(end - start).count();

    return {std::string(hashed), difficulty, std::round(elapsedMs * 100.0) / 100.0};
}

/**
 * Verify a password against a hash.
 */
bool verifyPassword(const std::string& password, const std::string& hashed) {
    if (password.empty() || hashed.empty()) {
        throw std::invalid_argument("Password and hash cannot be empty");
    }

    return crypto_pwhash_str_verify(
        hashed.c_str(),
        password.c_str(),
        password.size()) == 0;
}

/**
 * Check if a hash needs rehashing with updated parameters.
 */
bool needsMigration(const std::string& hashed, int targetDifficulty = DEFAULT_DIFFICULTY) {
    const auto& preset = getPreset(targetDifficulty);
    return crypto_pwhash_str_needs_rehash(
        hashed.c_str(),
        preset.opslimit,
        preset.memlimit) != 0;
}

/**
 * Migrate a hash to a new difficulty if needed.
 */
HashResult* migrateHash(const std::string& password, const std::string& oldHash,
                         int targetDifficulty = DEFAULT_DIFFICULTY) {
    if (!verifyPassword(password, oldHash)) {
        throw std::invalid_argument("Password does not match the provided hash");
    }

    if (needsMigration(oldHash, targetDifficulty)) {
        auto* result = new HashResult(hashPassword(password, targetDifficulty));
        return result;
    }
    return nullptr;
}

/**
 * Benchmark hashing and verification across difficulty presets.
 */
std::vector<BenchmarkResult> benchmark(int maxDifficulty = DEFAULT_DIFFICULTY, int iterations = 3) {
    if (iterations < 1) {
        throw std::invalid_argument("Iterations must be at least 1");
    }

    const std::string testPassword = "BenchmarkPassword!123";
    std::vector<BenchmarkResult> results;
    int maxLevel = std::min(maxDifficulty, MAX_DIFFICULTY);

    for (int level = MIN_DIFFICULTY; level <= maxLevel; level++) {
        const auto& preset = getPreset(level);
        double totalHashMs = 0;
        double totalVerifyMs = 0;

        for (int i = 0; i < iterations; i++) {
            // Time hashing
            char hashed[crypto_pwhash_STRBYTES];
            auto start = std::chrono::high_resolution_clock::now();
            crypto_pwhash_str(hashed, testPassword.c_str(), testPassword.size(),
                              preset.opslimit, preset.memlimit);
            auto end = std::chrono::high_resolution_clock::now();
            totalHashMs += std::chrono::duration<double, std::milli>(end - start).count();

            // Time verification
            start = std::chrono::high_resolution_clock::now();
            crypto_pwhash_str_verify(hashed, testPassword.c_str(), testPassword.size());
            end = std::chrono::high_resolution_clock::now();
            totalVerifyMs += std::chrono::duration<double, std::milli>(end - start).count();
        }

        results.push_back({
            level,
            preset.name,
            std::round((totalHashMs / iterations) * 100.0) / 100.0,
            std::round((totalVerifyMs / iterations) * 100.0) / 100.0,
            iterations
        });
    }

    return results;
}

void printUsage() {
    std::cout << "Bcrypt Password Hasher (libsodium)\n"
              << "Usage:\n"
              << "  bcrypt-hasher hash <password> [-d difficulty]\n"
              << "  bcrypt-hasher verify <password> <hash>\n"
              << "  bcrypt-hasher benchmark [-d difficulty] [-i iterations]\n"
              << "  bcrypt-hasher migrate <password> <hash> [-d difficulty]\n"
              << "\n"
              << "Difficulty levels: 1=minimum, 2=interactive, 3=moderate, 4=sensitive\n";
}

int getIntFlag(int argc, char* argv[], const std::string& flag, int defaultValue) {
    for (int i = 0; i < argc - 1; i++) {
        if (std::string(argv[i]) == flag) {
            return std::stoi(argv[i + 1]);
        }
    }
    return defaultValue;
}

int main(int argc, char* argv[]) {
    if (sodium_init() < 0) {
        std::cerr << "Error: Failed to initialize libsodium\n";
        return 1;
    }

    if (argc < 2) {
        printUsage();
        return 1;
    }

    std::string command = argv[1];

    try {
        if (command == "hash") {
            if (argc < 3) {
                std::cerr << "Usage: bcrypt-hasher hash <password> [-d difficulty]\n";
                return 1;
            }
            int difficulty = getIntFlag(argc, argv, "-d", DEFAULT_DIFFICULTY);
            auto result = hashPassword(argv[2], difficulty);
            std::cout << result.toJson() << "\n";

        } else if (command == "verify") {
            if (argc < 4) {
                std::cerr << "Usage: bcrypt-hasher verify <password> <hash>\n";
                return 1;
            }
            bool valid = verifyPassword(argv[2], argv[3]);
            std::cout << "{\"valid\": " << (valid ? "true" : "false") << "}\n";
            return valid ? 0 : 1;

        } else if (command == "benchmark") {
            int difficulty = getIntFlag(argc, argv, "-d", DEFAULT_DIFFICULTY);
            int iter = getIntFlag(argc, argv, "-i", 3);
            auto results = benchmark(difficulty, iter);
            std::cout << "[\n";
            for (size_t i = 0; i < results.size(); i++) {
                std::cout << "  " << results[i].toJson();
                if (i < results.size() - 1) std::cout << ",";
                std::cout << "\n";
            }
            std::cout << "]\n";

        } else if (command == "migrate") {
            if (argc < 4) {
                std::cerr << "Usage: bcrypt-hasher migrate <password> <hash> [-d difficulty]\n";
                return 1;
            }
            int difficulty = getIntFlag(argc, argv, "-d", DEFAULT_DIFFICULTY);
            auto* result = migrateHash(argv[2], argv[3], difficulty);
            if (result) {
                std::cout << "{\"migrated\": true, \"hashed\": \"" << result->hashed
                          << "\", \"difficulty\": " << result->difficulty
                          << ", \"elapsed_ms\": " << std::fixed << std::setprecision(2)
                          << result->elapsedMs << "}\n";
                delete result;
            } else {
                std::cout << "{\"migrated\": false, \"reason\": \"Hash already at target strength\"}\n";
            }

        } else {
            printUsage();
            return 1;
        }
    } catch (const std::exception& e) {
        std::cerr << "Error: " << e.what() << "\n";
        return 1;
    }

    return 0;
}

# Bcrypt Password Hasher (C++ - Trial 1)

A password hashing utility using libsodium for secure password hashing with configurable difficulty, benchmarking, and hash migration support.

## Dependencies

- **libsodium** (1.0.19): Modern cryptographic library providing Argon2id password hashing

## Build

```bash
mkdir build && cd build
cmake ..
make
```

## Usage

### Hash a password
```bash
./bcrypt-hasher hash "mypassword" -d 2
```

### Verify a password
```bash
./bcrypt-hasher verify "mypassword" "$argon2id$..."
```

### Benchmark difficulty levels
```bash
./bcrypt-hasher benchmark -d 3 -i 5
```

### Migrate a hash
```bash
./bcrypt-hasher migrate "mypassword" "$argon2id$..." -d 3
```

## Difficulty Levels

| Level | Name        | Description                     |
|-------|-------------|---------------------------------|
| 1     | minimum     | Minimum security (testing only) |
| 2     | interactive | Suitable for online services    |
| 3     | moderate    | Moderate security               |
| 4     | sensitive   | Maximum security                |

## Features

- Configurable difficulty levels mapping to libsodium's opslimit/memlimit
- Password hashing and verification
- Benchmark mode to compare difficulty level performance
- Hash migration to upgrade weaker hashes to stronger parameters
- JSON output for easy integration