Why we are still using PBKDF2-SHA256 despite being aware of its limitations
1–10 of 97 posts
Re: Why we are still using PBKDF2-SHA256 despite being aware of its limitations
#2What's wrong with PBKDF2-SHA256? I use PBKDF2-HMAC-SHA256 for an almost-stateless password manager.
Re: Why we are still using PBKDF2-SHA256 despite being aware of its limitations
#3If it's not broke, don't fix it. The underlying hasher is most important anyway. Crappy passwords will always be susceptible to rainbow attacks.
Re: Why we are still using PBKDF2-SHA256 despite being aware of its limitations
#4If it's not broke, don't fix it. The underlying hasher is most important anyway. Crappy passwords will always be susceptible to rainbow attacks.
No, not with salt and a high enough iteration count, they won't be.
Re: Why we are still using PBKDF2-SHA256 despite being aware of its limitations
#5What's wrong with PBKDF2-SHA256? I use PBKDF2-HMAC-SHA256 for an almost-stateless password manager.
[deleted]
Re: Why we are still using PBKDF2-SHA256 despite being aware of its limitations
#6What's wrong with PBKDF2-SHA256? I use PBKDF2-HMAC-SHA256 for an almost-stateless password manager.
SHA and MD are fast hashers. You want slow hashers for password security like b-crypt and s-crypt.
Re: Why we are still using PBKDF2-SHA256 despite being aware of its limitations
#7Re: Why we are still using PBKDF2-SHA256 despite being aware of its limitations
#8Pbkdf2 itself is not the best for the same reasons why sha256 was listed. I do agree that argon2 is better.
Re: Why we are still using PBKDF2-SHA256 despite being aware of its limitations
#9If I understood correctly, the points are:
- using longer passwords (or salts) is better than increasing the number of rounds
- having the same database on different devices (top-CPU x older cellphone) have impacts on the performance for the user but not for the attacker (as a powerful hardware will be used)
Seems fair, for the average user. And the top user will prefer a longer password anyway.
Re: Why we are still using PBKDF2-SHA256 despite being aware of its limitations
#10Earlier quoted context omitted.
SHA and MD are fast hashers. You want slow hashers for password security like b-crypt and s-crypt.
Doesn't PBKDF2 fix that as long as you use a very large number of irritations?
In theory, absolutely.
In practice, bitwarden's server limits the max iteration count on a user account to something that remains insecure. They refuse to fix it.