Viewing profile — emboss

General-purpose hash functions should be as efficient as possible. That's why they shouldn't be used for password hashing directly. There are special hash functions (slow, memory-i…

Hmm, that's an interesting idea. Although I could imagine that this approach ultimately leads to something like Universal Hashing. For example, if the functions you would use in yo…

Thank you! I hope we (or others) can manage to break some more hashes to raise the awareness of this problem! See also this nice example for btrfs: http://crypto.junod.info/2012/12…

If OpenSSL::Random isn't working (because OpenSSL is not installed for example) there is also SecureRandom in the stdlib. It tries to do the right thing in any situation: Use OpenS…

You're welcome - and thank you!

Implementations: C: https://github.com/floodyberry/siphash Go: https://github.com/dchest/siphash C: https://github.com/emboss/siphash-c Ruby: https://github.com/emboss/siphash-ruby…

Since it was standardized by ITU, it's still used in newer telecom protocols, and it's pervasively used throughout higher level cryptography-related protocols/standards, CAdES is o…

I find their attitude worrying - how can something be overstated if it's essentially possible for anyone to take down servers as easy as that? It's possible, so it must be fixed, t…

Minor nitpicking: > unlike in Java, you can also call a class method on an instance It's possible in Java, too. It's just considered bad practice. Still, a very nice read!

Maybe the question is asked from the wrong perspective - it's not that designers of cryptographic hash functions ask themselves "Hmm, so how fast/slow do we want this thing to be?"…

While we agree on the fact that using either of the three can't be a bad thing, I'd like to give my opinion on why I favor PBKDF2 over bcrypt, and probably even over scrypt, althou…