3 ms·
> Your crypto choices seem somewhat unusual. PBKDF2, while not necessarily unsafe, is a fairly old KDF to choose for a new product. Can you go into more detail
by veeti 10y ago
> Your crypto choices seem somewhat unusual. PBKDF2, while not necessarily unsafe, is a fairly old KDF to choose for a new product. Can you go into more detail about your rationale for choosing this over newer KDFs?
What would you recommend for resource constrained environments, like mobile phones? PBKDF2 is already very slow (from a UX perspective) on low- and mid-range Android phones. You also don't have the luxury of having tons of RAM available for a memory hard KDF.
- zokier 10y agoThe slowness generally is configurable parameter ("work factor" or some such) and the value is a trade-off between security and usability. The choice of KDF does not really enter into the picture, I think all of mainstream ones can be configured to be fast enough for mobile devices.
- veeti 10y agoIs there any real advantage to using, say, scrypt or Argon2 if you're going to be turning its work factor down to "PBKDF2 level" anyway? I could be wrong, but seems like diminishing returns. From a practical point of view, PBKDF2 ain't broke and is already available out of the box almost everywhere.