3 ms·
> "Furthermore, don't confuse password hashing algorithms with simple cryptographic hash functions. They're not the same thing:" "Password hashing algorithms"
by elithrar 11y ago
> "Furthermore, don't confuse password hashing algorithms with simple cryptographic hash functions. They're not the same thing:"
"Password hashing algorithms" should probably be replaced with "key derivation functions" - which makes it clearer what they are, and makes further reading (by the reader) into KDFs easier.
- deleted 11y ago[deleted]
- dchest 11y agoFor Password Hashing Competition (https://password-hashing.net/ https://password-hashing.net/) we tried to come up with a better term, which describes both password-based KDF and password hashing for server storage, but couldn't, so it's been decided to keep calling those things "password hashes". - "KDF" says nothing about passwords (e.g. see HKDF) and, - "PBKDF" (password-based KDF) says nothing about password verifier, such as for server storage (e.g. bcrypt doesn't produce a "key"), plus already taken by specific algorithms, - "password hash" sounds good for both key derivation and verifier, but makes it easy to confuse with normal hashes.