3 ms·
What evidence do you have that your scheme is any more future proof than, say, Argon2? No, just using a bunch of different primitives is not going to guard agai
by gliptic 10y ago
What evidence do you have that your scheme is any more future proof than, say, Argon2? No, just using a bunch of different primitives is not going to guard against the kind of breaks found in bcrypt or scrypt, which aren't really breaks at all.
- marcusfrex 10y agoForgiva is not a key-derivation algorithm itself to compare with Argon2 but a combination way for various hashing and encryption algorithms along PBKDF2 "depending on master-key". So it's as much future-proof as master-key generated algorithm sequence. And in this case which methods would you offer and prefer for future-proofing with comparison to other KDFs?
- gliptic 10y agoI would use an analysed algorithm such as Argon2 and be done with it. If you're so worried about bcrypt, why do you use PBKDF2 which is no better?
- marcusfrex 10y agoActually i am not worried about bcrypt. I just wanted to use more enterprise level approved KDF other than individual work. But regarding criticizes probably there will be bcrypt, scrypt and argon2 implementations as options on the next release.