Don't use bcrypt
unlimitednovelty.com
Don't use bcrypt
1–10 of 193 posts
Re: Don't use bcrypt
#2However, if you're looking for a key derivation function for a new project, bcrypt is probably not the best one you can pick.
I'm confused. Why would I pick bcrypt as a key derivation function when there are nice key derivation functions out there that are widely documented?
Re: Don't use bcrypt
#3I like this article. But this sentence is odd.
> […] with an academic pedigree from RSA Labs, you know, the guys who invented much of the cryptographic ecosystem we use today.
Appeal to authority fails a little bit when RSA opens random Excel attachments from unknown untrusted sources - attached to an email that have to be retrieved from the junk mail folder.
(http://blogs.rsa.com/rivner/anatomy-of-an-attack/)
EDIT: As other commentators point out, I am wrong to suggest that anything coming from RSA Labs is somehow "weak" because someone at RSA fell for a phishing attack. I do find it odd that a security article suggests "These people are good; they did 'this thing' which everyone uses". That's not a great way to approach choosing crypto components. Even experts make mistakes.
Re: Don't use bcrypt
#4tl;dr
PBKDF2 and scrypt each have supposed upsides to bcrypt and all the benefits.
PBKDF2: RSA tested and widely used. scrypt: memory hard as well.
Re: Don't use bcrypt
#5Long story short, if a bcrypt exploit is found, you'll be sorry. So use http://en.wikipedia.org/wiki/PBKDF2 or http://www.tarsnap.com/scrypt.html instead. They're apparently better tested.
I'm no expert opinion, but seems a bit unnecessary and that bcrypt is still a perfectly good choice for most password stores.
Re: Don't use bcrypt
#6However, if you're looking for a key derivation function for a new project, bcrypt is probably not the best one you can pick. I'm confused. Why would I pick bcrypt as a key derivation function when there are nice key derivation functions out there that are widely documented?
As stated in the article, a popular stance on Hacker News and Stack Overflow is "USE BCRYPT". It's chanted to crypto-noobs and webdevs as a simple-to-use library for password storage that is more secure than MD5/SHA/Whatever hashing, and with built-in salts.
The whole point of this article is to say that, in fact, there are other options.
Re: Don't use bcrypt
#7[deleted]
Re: Don't use bcrypt
#8> While scrypt's cryptographic soundness, like bcrypt's, is poorly researched
I think we may have different notions of what "poorly researched" means.
Re: Don't use bcrypt
#9Note that scrypt uses PBKDF2 before and after the memory-hard function.
Re: Don't use bcrypt
#10Note that scrypt uses PBKDF2 before and after the memory-hard function.
Only as a cryptographic mixing/expansion function. There is no reason to think that scrypt's security would be any less if the PBKDF2 calls were replaced with xor.