4 ms·
Wait, don't you want minimum acceptable throughput on security-related hashing, so that it becomes less likely that somebody can just brute-force it?
by qwertyuiop924 10y ago
Wait, don't you want minimum acceptable throughput on security-related hashing, so that it becomes less likely that somebody can just brute-force it?
- deleted 10y ago[deleted]
- xxs 10y agoNot everything hashish ends up being salted passwords. Hashing is great for just hashtables and partioning.
- qwertyuiop924 10y agoAh, that makes sense. Thanks.
- revelation 10y agoThis is evaluating hash functions for use in something like a hash table where the concern is first and foremost for speed at goodish distribution, not collision resistance. The security (DoS rather) issue with hash tables is more that 1) attackers often control the input, and H(a) == H(a) obviously and 2) the hash function output is reduced to a few bits to decide which bucket to put something into. In those cases making your hash function slower just makes you more susceptible.
- aras_p 10y agoYeah I forgot to mention that even if most of the time you don't care about "security concerns" with regular hashtables, there are cases where a weakness in your hashtable can be used to bring some of your services down. That has happened! However, many of the times that is not a concern, but as always, case by case basis.
- JoshTriplett 10y agoFor hashing, you want the maximum possible throughput. If you want to hash a password, you can always iterate the hash function to add difficulty, or better yet, use a mechanism specifically designed for hashing passwords, such as scrypt, bcrypt, or PKBDF2.
- vmasto 10y agoOr the most recent Argon2, but I've learned to give crypto hashers a good 5 years before using in production.
- deleted 10y ago[deleted]