3 ms·
Yes, but it's after 100,000 rounds of PBKDF2.
by pwman 11y ago
Yes, but it's after 100,000 rounds of PBKDF2.
- epistasis 11y agoChaining hashes seems like a great way to get the benefits of both, and to have an extra layer in case one falls. Why isn't that done more commonly in practice?
- timmclean 11y agoMainly because it adds complexity, and complexity in crypto can hide subtle bugs. Example: http://blog.ircmaxell.com/2015/03/security-issue-combining-bcrypt-with.html http://blog.ircmaxell.com/2015/03/security-issue-combining-b...
- ejcx 11y agoI've actually seen it cause numerous issues. For example, consider this pseudocode: // Returns binary data shaPass = crypto.sha256(userPassword) // returns an scrypt password crypto.bcrypt(shaPass) I've seen many people pass binary data into functions that will terminate reading the string at a null byte. This obviously limits the strength of the number of bytes before a null byte is hit in the binary data (mostly only concerns PHP and C). Just noticed someone else posted the ircmaxwell blog, which is the best writing on this topic.