3 ms·
Wish there was a site where it lists algorithms and gives a table, and an ability to compare it to x years ago: algorith | fairly safe difficulty (all variable
by Justsignedup 11y ago
Wish there was a site where it lists algorithms and gives a table, and an ability to compare it to x years ago:
algorith | fairly safe difficulty (all variables) | very safe difficulty without incurring too much performance cost.
pbkdf + sha1 | completely unsafe | completely unsafe
pbkdf + sha2 | 100000 | ...
pbkdf + sha256
bcrypt
scrypt
argon2
- tptacek 11y agoPBKDF2-SHA1 is safe. That's the problem with a chart like this. The gradation will go from "completely unsafe" salted hashes to "very much safe enough" with only marginal changes after that. Another problem is that these functions are all parameterized, so the chart needs to capture the safety level at specific parameters.
- sarciszewski 11y agoIt would make for a good interactive "chart", perhaps. Whereby, as long as your sliders aren't all the way to the left, the chart is mostly green.
- Justsignedup 11y agoMy goal was to create a chart of: algorith | a safe set of parameters | a VERY safe set of parameters but needs strong hardware Maybe a 4th column of "unsafe if difficulty is below" This could be something updated yearly or whatever to help people figure out what things they need to move towards. If they see that their currently used settings are below the unsafe line, they will know it's time to upgrade. Example: I use PBKDF2-SHA1 at difficulty of 11k iterations. Is that number still within the "probably okay" list, or is that in the "I can hack any password on your list in 15 minutes"