Hello,

Interoperability is quite important for us, since we have 4 different software developed in different languages (Java, C#, C++, PHP) using the same database.

We have detected a very serious interoperability issue with this library when dealing with long password (and truncating strategy).

If we generate a hash like this:

String hash = BCrypt.with(BCrypt.Version.VERSION_2Y, new SecureRandom(), LongPasswordStrategies.truncate()).hashToString(12, password.toCharArray());

With password =

password_longer_than_72_bytes_abcdefghijklmnopqrstuvwxyz0123456789_abcdefghijklmnopqrstuvwxyz0123456789

We obtain hash = $2y$12$BhmM4lJ91dMTHQoh3XgxY.QZg2j1EfH6DpiwmgufAAHImqCSvA/b.

If we take this hash and try to verify it using PHP (using password_verify()), the check will fail.

You can quickly try it using this handy online tool: https://bcrypt-generator.com

After looking into the code, we though that the issue could come from the truncating strategy.
We tried overriding the MAX_PW_LENGTH_BYTE:

public static final int MAX_PW_LENGTH_BYTE = 72;

The new hash generated was $2y$12$wHUr.PTUQPb7.CsK/0jHq.G4m6uIiHinBDBsWf2/cnwwwANZceQYm

And this one works: