5 ms·
Wouldn't it be wise to wait for argon2 to get some more cryptanalysis and testing in the field before jumping on it, sticking to scrypt or bcrypt in the meantim
by beefhash 11y ago
Wouldn't it be wise to wait for argon2 to get some more cryptanalysis and testing in the field before jumping on it, sticking to scrypt or bcrypt in the meantime?
- tptacek 11y agoNo. The reason not to use Argon2 is that it doesn't have great library support yet. Password hashes don't really fail like ciphers do. Nothing that is discovered in Argon2 is going to make it worse than PBKDF2, and using PBKDF2 is just fine if that's all you've got.
- dsacco 11y ago>> and using PBKDF2 is just fine if that's all you've got. Yeah, people spend way too much time wondering if they should use scrypt, bcrypt, PBKDF2, etc. There are legitimate differences, but unless you know those ahead of time it's almost certainly better to just choose one instead of waffling around.
- technion 11y agoThe reference library we do have looks set to make further breaking changes[0], which complicates this further. [0] https://github.com/P-H-C/phc-winner-argon2/pull/119/files https://github.com/P-H-C/phc-winner-argon2/pull/119/files
- devit 11y agoHuh? A password hash could happen to be reversible, or could map lots of passwords to the same value.
- tptacek 11y agoNo, neither of those things are going to happen. It might happen if you designed a password hash from first principles, but that is not how Argon2 was designed, or, really, any of the Password Hashing Contest finalists. They're built on top of existing crypto primitives.