11–20 of 193 posts
Long story short, if a bcrypt exploit is found, you'll be sorry . So use http://en.wikipedia.org/wiki/PBKDF2 or http://www.tarsnap.com/scrypt.html instead. They're apparently better tested. I'm no expert opinion, but seems a bit unnecessary and that bcrypt is still a perfectly good choice for most password stores.
I like this article. But this sentence is odd. > […] with an academic pedigree from RSA Labs, you know, the guys who invented much of the cryptographic ecosystem we use today. Appeal to authority fails a little bit when RSA opens random Excel attachments from unknown untrusted sources - attached to an email that have to be retrieved from the junk mail folder. ( http://blogs.rsa.com/rivner/anatomy-of-an-attack/ ) EDIT…
Edit: realized I should probably explain. What an administrative assistant does in a social engineering attach has nothing to do with the quality of cryptographic research at RSA. Humans are ALWAYS the weak point in cryptography.
However, if you're looking for a key derivation function for a new project, bcrypt is probably not the best one you can pick. I'm confused. Why would I pick bcrypt as a key derivation function when there are nice key derivation functions out there that are widely documented?
As stated in the article, a popular stance on Hacker News and Stack Overflow is "USE BCRYPT". It's chanted to crypto-noobs and webdevs as a simple-to-use library for password storage that is more secure than MD5/SHA/Whatever hashing, and with built-in salts. The whole point of this article is to say that, in fact, there are other options.
> While scrypt's cryptographic soundness, like bcrypt's, is poorly researched I think we may have different notions of what "poorly researched" means.
Earlier quoted context omitted.
As stated in the article, a popular stance on Hacker News and Stack Overflow is "USE BCRYPT". It's chanted to crypto-noobs and webdevs as a simple-to-use library for password storage that is more secure than MD5/SHA/Whatever hashing, and with built-in salts. The whole point of this article is to say that, in fact, there are other options.
[deleted]
EDIT: The context was comparing 1. converting passwords into keys for cryptographic purposes and 2. hashing passwords to be used for logins.
> While scrypt's cryptographic soundness, like bcrypt's, is poorly researched I think we may have different notions of what "poorly researched" means.
I think he meant it hasn't undergone the same level of public scrutiny. You've certainly spent ample time researching it, and it's obviously been tested, but possibly not as much something like AES.
PBKDF2 has had longer public exposure, and also features an adjustable CPU work factor (though with a lower theoretical safety-to-compute-time than bcrypt).
scrypt is newer, but features both a CPU and memory work factor (memory-hard algorithm), and is algorithmically superior to both.
I like this article. But this sentence is odd. > […] with an academic pedigree from RSA Labs, you know, the guys who invented much of the cryptographic ecosystem we use today. Appeal to authority fails a little bit when RSA opens random Excel attachments from unknown untrusted sources - attached to an email that have to be retrieved from the junk mail folder. ( http://blogs.rsa.com/rivner/anatomy-of-an-attack/ ) EDIT…
As does ad hominem... Edit: realized I should probably explain. What an administrative assistant does in a social engineering attach has nothing to do with the quality of cryptographic research at RSA. Humans are ALWAYS the weak point in cryptography.
The crypto space can be intimidating to your average dev, but almost every app needs some sort of protection (at least for user information). I think the author is fair in wanting to push for the "default" to be PBKDF2 instead of bcrypt, but should he really be advocating a less-tested function in the same article?
scrypt is better than bcrypt.
bcrypt has the advantage of being both very good, and also broadly available on web platforms. scrypt does not yet have that advantage; when it does, I will start saying "just use scrypt".
But the simple fact is: all three of these functions are fine. ANY of them is a huge step forward from what people do without them.
"Just use bcrypt" is 1000x more effective as a meme than "just use adaptive hashing" (which is what all these constructions are).
So, while I have few specific technical qualms with this article (e.g. why do I care whether something is a PKCS standard or not?), the overall message is a bit hyperbolic.