How is being from RSA labs an advantage? I'd estimate that it's more likely that there are government backdoors in RSA crypto than in other variants.
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA IT BURNS IT BURNS
Don't use bcrypt
51–60 of 193 posts
Re: Don't use bcrypt
#52Earlier quoted context omitted.
I can't share anything. All I can do is respect the peer review process. I'm certainly not making the real appeal to authority of "they are a big company, so they make good ciphers". If you have something specific, I'd love to hear it. In particular, I'd like to hear how social engineering negatively impacts cipher algorithms (negatively impacting key security doesn't count).
What can you tell us about the actual peer review process that you think was involved with PBKDF2? (Me just saying it won't be nearly as impactful, because apparently I'm in the tank for bcrypt). Don't know? This will make a worthwhile 30 minute Googling project. That's what I do when I get in over my head, and I promise, learning about adaptive hashing is going to be more useful than reading court decisions about wh…
You seem to have the mistaken opinion I'm arguing for a particular outcome. My point is simple: you can't say RSA is crap because an admin failed. I'm not saying anything else. If you are reading something else into my statement, stop it. If you have information that is relevant to why you shouldn't trust the ciphers from RSA, dish it up. Like I said, I'd love to read it.
It is possible to point out a logical phalacy while having no beliefs (or, in fact, deep knowledge [or, perhaps, religion?]) regarding what the phalacy pertains to.
Re: Don't use bcrypt
#53Earlier quoted context omitted.
What can you tell us about the actual peer review process that you think was involved with PBKDF2? (Me just saying it won't be nearly as impactful, because apparently I'm in the tank for bcrypt). Don't know? This will make a worthwhile 30 minute Googling project. That's what I do when I get in over my head, and I promise, learning about adaptive hashing is going to be more useful than reading court decisions about wh…
You seem to have the mistaken opinion I'm arguing for a particular outcome. My point is simple: you can't say RSA is crap because an admin failed. I'm not saying anything else. If you are reading something else into my statement, stop it. If you have information that is relevant to why you shouldn't trust the ciphers from RSA, dish it up. Like I said, I'd love to read it. It is possible to point out a logical phalacy…
No, I'm asking you to take a subject you're obviously engaged in and spend a couple minutes researching it before you write your next comment about it. Not to be a jerk, but because (a) the whole thread would benefit and (b) I can vouch, for you, that this is worth your time as a software developer to do.
So: up for it? Is a couple minutes of Google time and the direct attention from several software security experts to learn lots and lots about key derivation functions and password hashes worth it to you?
Re: Don't use bcrypt
#54This article doesn't feel very well done to me. He writes: "The first cipher I'd suggest you consider besides bcrypt is PBKDF2."
PBKDF2 is not a cipher. It's a KDF, and it's almost always used with an HMAC or a cryptographic hash rather than a cipher. The thesis of this article seems to be "PBKDF2 is well understood, where bcrypt is not." In fact, the opposite is probably true.
bcrypt uses a block cipher (blowfish) to create its underlying compression function. Block ciphers are extremely well understood, have been studied to death for years, and are modeled on extremely well understood constructs. They can be used to create cryptographic hash functions, but usually aren't, because they're slow (which we don't care about in this case).
Cryptographic hash functions, by contrast, are not well understood at all. They are "magic" in many ways, and aren't modeled after anything. Many more "bad things" happen in this space than in the block cipher space. The only reason people mess with them at all is because they're faster than block ciphers, which again, we don't care about in this case.
The other appeal to PBKDF2 is because it "comes from RSA." This doesn't feel like an extremely compelling argument, but if we were going to believe it, then why not use the PKCS#12 KDF? PBKDF2 was proposed in PKCS#5, and "12" is a larger number than "5", so if we're going to do what RSA tells us we should do, they're essentially saying we shouldn't actually use PBKDF2.
Re: Don't use bcrypt
#55> I write this post because I've noticed a sort of "JUST USE BCRYPT" cargo cult... This is absolutely the wrong attitude to have about cryptography. No. This is incorrect. This is exactly the right attitude for most developers to have about cryptography, because on a subject as complex as cryptography most developers (including me!) are nowhere near smart enough to understand the ins and outs. Encouraging people to m…
That attitude is abrasively condescending.
Why not just say, "people who spent a lot of their time studying cryptography strongly recommend this approach. They feel the approach that you are considering is simply insecure."?
Framing things in terms of intelligence isn't going to win anyone over, if that's your goal. And it probably isn't accurate, either.
Re: Don't use bcrypt
#56> I write this post because I've noticed a sort of "JUST USE BCRYPT" cargo cult... This is absolutely the wrong attitude to have about cryptography. No. This is incorrect. This is exactly the right attitude for most developers to have about cryptography, because on a subject as complex as cryptography most developers (including me!) are nowhere near smart enough to understand the ins and outs. Encouraging people to m…
The point here is that this particular cargo cult around bcrypt (one subscribed to by some really loud people) has a shaky foundation and does not deserve its reputation. He's offering alternatives that have been better studied.
So, by all means, subscribe to a cargo cult for crypto. But pick the cult carefully.
Re: Don't use bcrypt
#57> I write this post because I've noticed a sort of "JUST USE BCRYPT" cargo cult... This is absolutely the wrong attitude to have about cryptography. No. This is incorrect. This is exactly the right attitude for most developers to have about cryptography, because on a subject as complex as cryptography most developers (including me!) are nowhere near smart enough to understand the ins and outs. Encouraging people to m…
That attitude is abrasively condescending. Why not just say, "people who spent a lot of their time studying cryptography strongly recommend this approach. They feel the approach that you are considering is simply insecure."? Framing things in terms of intelligence isn't going to win anyone over, if that's your goal. And it probably isn't accurate, either.
Sounds pretty close to accurate to me. Do you want to feel good, or do you want to choose good crypto? Pick one or the other.
Re: Don't use bcrypt
#58> I write this post because I've noticed a sort of "JUST USE BCRYPT" cargo cult... This is absolutely the wrong attitude to have about cryptography. No. This is incorrect. This is exactly the right attitude for most developers to have about cryptography, because on a subject as complex as cryptography most developers (including me!) are nowhere near smart enough to understand the ins and outs. Encouraging people to m…
The point here is that this particular cargo cult around bcrypt (one subscribed to by some really loud people) has a shaky foundation and does not deserve its reputation. He's offering alternatives that have been better studied. So, by all means, subscribe to a cargo cult for crypto. But pick the cult carefully.
He's wrong. (Read downthread for why I said this; my bluntness here is a mercy).
Re: Don't use bcrypt
#59tl;dr PBKDF2 and scrypt each have supposed upsides to bcrypt and all the benefits. PBKDF2: RSA tested and widely used. scrypt: memory hard as well.
"Memory hard" is a serious benefit that scrypt actually has. "RSA tested and widely used" is subjective, not particularly meaningful, and in some senses erroneous, and so makes a poor case for PBKDF2. If people want to seriously push for scrypt as a replacement for bcrypt as the "default" function, I'll design and print flags and pennants for the movement. But when people say "use PBKDF2 instead of bcrypt", I think t…
Question: what does "memory hard" mean? Uses lots of RAM to preclude simultaneous connections running attempts in parallel?
Re: Don't use bcrypt
#60I guess it's hip to have an opinion, but JUST USE BCRYPT. It's secure and available. Don't spend time thinking about it, just use bcrypt, it does everything you want, move on to something more worth your time.
Unless you're some blogger who needs to generate some page views, then pick some obscure topic like how to store password hashes and rake muck.