3 ms·
I am referring to limiting password to a small number. Of course no one should take in a password > 32 characters. bcrypt has limitation itself. A reasonable an
by yeukhon 9y ago
I am referring to limiting password to a small number. Of course no one should take in a password > 32 characters. bcrypt has limitation itself. A reasonable and practical limit is 32, so we can prevent DoS attack because encrypt/decrypt takes up a chunk of CPU resource. I'd be surprise anyone go beyond that (for a "passphrase").
- zokier 9y ago32 characters is very low limit. I checked and the average word length is about 7 chars. So 5 word passphrase would be 39 chars. And that is not very extreme example
- IncRnd 9y agoYou are giving bad advice. bcrypt's maximum password length is not 32 bytes. In fact the maximum has been debated due to discrepancies from the paper describing it and the first implementation, which actually accepted longer passwords due to how it handled words internally. In either case the max length is at least 20 characters more than you state. Your own words above: "because encrypt/decrypt takes up" is 32 bytes. By most measures a five word passphrase fitting into 32 bytes doesn't even contain 80 bits of entropy.