21–25 of 25 posts
Earlier quoted context omitted.
Thank god the scripts are open source. You can actually read them and figure out what they do. Shocking!
You could do that but I doubt that people who > would rather not read our entire security guide (though we suggest you do) are the kind of people who read bash/chef source code.
The password hashing algorithm outlined is really not best practise, only 7 rounds and the use of SHA-256 which is a general cryptographic hash, not a password specific one. The correct answer to password hashing is still mostly "just use bcrypt", or even better, scrypt or argon2. Failing that PBKDF2 with enough rounds is not terrible, if you have to. All of these algorithms should to be tuned to require as much proc…
I've had a lengthy debate and discussion about this with a number of cryptographers. Here's the math we came up with that appears to allow for SHA and other hashes (blog post will be coming eventually). Please correct me if anything is wrong: ---------------- High end GPU hardware can do about 1T (1e12) hashes per second. This is top end stuff that is expensive, but available. Brute force attacks usually look somethi…
I'd urge you to reconsider having done so.
The problem with "please correct me if anything is wrong" is no one is going to invest significant man-hours reviewing yet another algorithm unless it comes with a detailed paper showing why it's better than the existing standard. Which it isn't, because there is no memory complexity here, and thus, Argon2 is a more interesting target.
Earlier quoted context omitted.
I've had a lengthy debate and discussion about this with a number of cryptographers. Here's the math we came up with that appears to allow for SHA and other hashes (blog post will be coming eventually). Please correct me if anything is wrong: ---------------- High end GPU hardware can do about 1T (1e12) hashes per second. This is top end stuff that is expensive, but available. Brute force attacks usually look somethi…
> ... all possible combinations of 8-16 characters with 100 character possibilities ... Yes, but this doesn't even come close to describing the typical users' password, which is most likely a 6-letter English word with a capital letter and a 1! appended to the end. Your calculation here isn't really relevant, because it's all about the worst or common case. (You also assume that people are using a GPU for a compute-b…
Earlier quoted context omitted.
> ... all possible combinations of 8-16 characters with 100 character possibilities ... Yes, but this doesn't even come close to describing the typical users' password, which is most likely a 6-letter English word with a capital letter and a 1! appended to the end. Your calculation here isn't really relevant, because it's all about the worst or common case. (You also assume that people are using a GPU for a compute-b…
Simple passwords are mitigated by salting and slat modification. The guide covers both of these and hashing. This should be sufficient even against thousands of GPUs.