3 ms·
Once you've reached an appropriate security margin you shouldn't pour more resources into making it even slower. You don't typically need to choose between perf
by dsacco 9y ago
Once you've reached an appropriate security margin you shouldn't pour more resources into making it even slower. You don't typically need to choose between performance and security in a general sense, because you can achieve very good performance with very good security. Slowing down your password hashing function any further than is required is overkill, and won't improve your security.
- atemerev 9y agoToday's security margin is tomorrow's past news. Usually, security margins are planned against brute force according to Moore's law. This is not enough. Novel cryptographic attacks do not suddenly render the entire algorithm useless (usually); rather, they dramatically reduce its strength. And novel cryptographic attacks appear all the time even in the public space -- who knows what stays behind closed doors and clearances? If you have large enough security margin, you can escape unscathed while you upgrade your infrastructure. And if not, not.
- dsacco 9y agoSure, but even assuming Moore's Law, algorithms like SHA-2 and SHA-3 are not likely to broken within our lifetimes, if ever. For the set of hashing algorithms that are quantum-safe, you literally gain nothing in practice by making them arbitrarily stronger - they're already so strong that any increase in security margin is a negligible improvement slighter than a rounding error in computational time. But these improvements can come with a performance cost. There's generally no upside and only a downside for choosing to increase the strength beyond what's required for the sake of future proofing.