For a run-of-the-mill programmer, where are some places that I can look for crypto best practices? Eg. For storing passwords, Coda Hale's https://codahale.com/how-to-safely-store-a-password/ looks like it is still relevant, but how do I know that?
I know that cperciva and tptacek are some go-to people on HN, but where can I point other non-HN readers?
Ask HN: Current Crypto Best Practices
1–10 of 71 posts
Re: Ask HN: Current Crypto Best Practices
#2The golden rule about storing a password is to not store a password...
I can't wait till SQRL takes off
Re: Ask HN: Current Crypto Best Practices
#3OWASP has some nice guidelines on a lot of topics, including storing passwords.
Start at https://www.owasp.org/index.php/Password_Storage_Cheat_Sheet
Re: Ask HN: Current Crypto Best Practices
#4Cryptographic Right Answers is a good place to start
Re: Ask HN: Current Crypto Best Practices
#5The golden rule about storing a password is to not store a password... I can't wait till SQRL takes off
For reference: https://www.grc.com/sqrl/sqrl.htm
Re: Ask HN: Current Crypto Best Practices
#6The golden rule about storing a password is to not store a password... I can't wait till SQRL takes off
It won't.
See http://security.blogoverflow.com/2013/10/debunking-sqrl/
for a myriad of reasons.
I've also come to realize that one should take everything that SG says with a large table spoon of salt.
Re: Ask HN: Current Crypto Best Practices
#7A good guide for password hashing is https://paragonie.com/blog/2016/02/how-safely-store-password... . I think your codehale link is out of date since it's from 2010.
Re: Ask HN: Current Crypto Best Practices
#8Re: Ask HN: Current Crypto Best Practices
#9The IT Security StackExchange website contains lots of information which is generally kept reasonably up to date. For example a TLS answer might be a bit old and not list last week's attack, but if something turns incorrect it will often be edited.
Re: Ask HN: Current Crypto Best Practices
#10The golden rule about storing a password is to not store a password... I can't wait till SQRL takes off
It won't. See http://security.blogoverflow.com/2013/10/debunking-sqrl/ for a myriad of reasons. I've also come to realize that one should take everything that SG says with a large table spoon of salt.
> The proposed SQRL scheme derives all application specific keys from a single master key. This essentially provides a single juicy target for attackers to go after.
That sounds like the same problem password managers have. And yet they are still recommended over (re-)using your own passwords for each website.