3 ms·
This is a blog post responding to another blog post. The first one recommended using HMAC in a place where it is totally appropriate to use HMAC. The response
by justin_vanw 17y ago
This is a blog post responding to another blog post. The first one recommended using HMAC in a place where it is totally appropriate to use HMAC. The response seems to miss that point.
To store passwords in a database the 'proper hash' to use is openbsd's bcrypt. http://www.openbsd.org/papers/bcrypt-paper.ps http://www.openbsd.org/papers/bcrypt-paper.ps
- fexl 17y agoOne minor issue, I think. I noticed on page 7 it says: bcrypt(cost, salt, pwd) state <= EksBlowfishSetup(cost, salt, key) I guess the symbols "pwd" and "key" are synonyms there, right?
- justin_vanw 17y agoWell, the good news is that this paper is old, and bcrypt is readily available for most languages, including Ruby, Python and Java (and of course C).
- travisp 17y agoThat first blog post recommended using HMAC for communicating between applications, but then he said that he uses and recommends HMAC to store passwords in his database as well. I think that's what this post is responding to.
- justin_vanw 17y agoI agree, that would be a bad idea. I should have read the original more carefully.
- cynicalkane 17y agoIs there a PDF version of this? Or a way to read PS without installing new software? I'm on a computer that is not mine.
- tvon 17y agoI'll keep this up for a bit: http://civicit.com/~tvon/files/bcrypt-paper.pdf http://civicit.com/~tvon/files/bcrypt-paper.pdf
- cynicalkane 17y agoActually, after some googling, I've discovered a sequel to bcrypt: http://www.tarsnap.com/scrypt.html http://www.tarsnap.com/scrypt.html This algorithm is not only provably computationally hard, but provably requires a lot of RAM. Since RAM, and the bandwidth thereof, (unlike password-cracking chips) is as cheap to the consumer as it is to the NSA, you can set your RAM requirements very high to give them a very hard time.
- cperciva 17y agoThis algorithm is not only provably computationally hard, but provably requires a lot of RAM Almost right. There is a lower bound on the time-area product, but not a significant lower bound on the area.
- imurray 17y agoIs there...a way to read PS without installing new software? It's not great compared to say Google's viewer for PDFs, but here is a long-standing service that works: http://view.samurajdata.se/ http://view.samurajdata.se/