4 ms·
I had no idea that PBKDF2 had fallen so much in recent years. I still remember the 1Password team extolling its virtues five years ago: https://blog.agilebits.
by AdmiralAsshat 11y ago
I had no idea that PBKDF2 had fallen so much in recent years. I still remember the 1Password team extolling its virtues five years ago:
https://blog.agilebits.com/2011/05/05/defending-against-crackers-peanut-butter-keeps-dogs-friendly-too/ https://blog.agilebits.com/2011/05/05/defending-against-crac...
- sarciszewski 11y agoCorrection: Scrypt actually uses PBKDF2 internally. (Previously said "scrypt is based on PBKDF2" but that's a loaded statment.) PBKDF2 is an improvement over PBKDF1 (and other naive iterated hash constructions), but attacks got better and better defenses are called for.
- cperciva 11y agoScrypt is based on PBKDF2. No, it really isn't.
- sarciszewski 11y agoI could have sworn it used PBKDF2-SHA256 and Salsa20/8 internally, which is what I meant by "based on".
- cperciva 11y agoIt also uses xor internally, but I wouldn't say that scrypt is based on xor. scrypt does not use PBKDF2 for any PBKDF properties; it's just a convenient arbitrary-length-output hash function. I would have used a sponge if they had been widely available when I created scrypt.
- sarciszewski 11y agoOkay, thanks for the clarification.
- tptacek 11y agoQuestions like these are why I don't love the Password Hashing Competition. In reality, PBKDF2 is fine. It's not the best thing you can use, in the same sense as AES is probably not the absolute best round-for-round, cycle-for-cycle cipher you can use, but it gets the job done. The answer for "what password hash should I use" can accurately be summed as "put bcrypt, scrypt, Argon2, and PBKDF2 on a dartboard, and then throw a dart". In 1PW's case, PBKDF2 is even more reasonable, because 1PW actually needed a KDF, and bcrypt is not an especially good KDF.