Just trying to get some information... Lets say I did this.

state = b'MySecretKey'

_state = bcrypt.hashpw(state, bcrypt.gensalt())

_state = _state.decode('utf-8')

And then stored that in the Smart Contract as a storage State during deployment.

string state;

First, how can I get the constructor variables from the dictionary that is returned from?:

trx_ = w3.eth.getTransaction(trx)

Second, how long would it take to crack the encrypted state variable?

  • Isn't this just a question about how secure Bcrypt is? (As in, it's invariant of the fact it's stored in a smart contract. Getting it from the state data would be trivial for an attacker.) – Richard Horrocks Jan 25 '18 at 22:34
  • In which case, Information Security Stack Exchange is where you want to be: security.stackexchange.com/questions/tagged/bcrypt – Richard Horrocks Jan 25 '18 at 22:35
  • Well technically the getStorageAt() doesn't return the proper state variable and theres a question about getting the constructor variables from the getTransaction() response. So I'm not sure if you just can't answer those questions or don't want to, but that you for pointing me in the right direction. – Dorian Lee Jan 25 '18 at 23:47
  • Hi there. Using getStorageAt() would require you to determine the length of the array first (it's a string), then read the array from the correct position in the state data. (I think the position parameter is hashed to give the location of the data - I'd have to look at the code to remind myself.) Is that what you mean by it doesn't return the proper state variable? For your second question, are you asking how to decode the input field of the transaction? – Richard Horrocks Jan 26 '18 at 18:58
  • But regardless, they're both essentially O(1) complexity operations, whereas cracking a salted Bcrypt'ed password is practically impossible. (According to InfoSec SE.) – Richard Horrocks Jan 26 '18 at 19:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.