4 ms·

It's 2017, use libsodium: https://download.libsodium.org/doc/password_hashing/ https://download.libsodium.org/doc/password_hashing/.

jedisct1 9y ago
It's almost 2018, use libhydrogen: https://github.com/jedisct1/libhydrogen/wiki/Password-hashing https://github.com/jedisct1/libhydrogen/wiki/Password-hashin...
- LaGrange 9y ago
  Hm, seems less active, and in the non-goals: "Replacing libsodium. Libhydrogen focuses on being small and is for environments where libsodium cannot be used."
  - marcosdumay 9y ago
    > libsodium ... libhydrogen ... seems less active I imagine the later author wanted things this way.
    - SAI_Peregrinus 9y ago
      They're from the same author (jedisct1).
      - garmaine 9y ago
        You missed a chemistry joke.
        marcosdumay 9y ago
        Still, the "later author" is the same as the "leading author" and I could have said only "author".
  - jedisct1 9y ago
    I can't work on both simultaneously. As libsodium has become pretty much feature complete, and much more bloated that I initially wanted, I am now refocusing more on hydrogen. Since this is relevant to the original topic, the password hashing API is a good illustration of the difference between both libraries. New additions to libsodium must remain consistent with historic APIs, that have limitations and usability issues. Hydrogen learned from this, and tries to model its API after common problems to solve in real-world applications rather than provide interfaces to cryptographic primitives. This will eventually become the base of libsodium 2.x Of course, there's nothing wrong with using libsodium, if only because it's way more mature and implements conservative designs that you can trust. But feedback on Hydrogen would also be really great. I really want to avoid doing the same mistakes again, and build the best possible easy-to-use hard-to-misuse APIs that everybody can use confidently.
    - LaGrange 9y ago
      Ah. Khm. Now I looked at the username blushes. Um, TBH if I didn't read you here I'd assume the line in "non-goals" means you actively don't want me to use it in pretty much anything I ever do, and follow that. I'd probably have to roll my own binding anyway, but now I'll at least pay attention.

jedisct1 9y ago

It's almost 2018, use libhydrogen: https://github.com/jedisct1/libhydrogen/wiki/Password-hashing https://github.com/jedisct1/libhydrogen/wiki/Password-hashin...

LaGrange 9y ago
Hm, seems less active, and in the non-goals: "Replacing libsodium. Libhydrogen focuses on being small and is for environments where libsodium cannot be used."
- marcosdumay 9y ago
  > libsodium ... libhydrogen ... seems less active I imagine the later author wanted things this way.
  - SAI_Peregrinus 9y ago
    They're from the same author (jedisct1).
    - garmaine 9y ago
      You missed a chemistry joke.
      - marcosdumay 9y ago
        Still, the "later author" is the same as the "leading author" and I could have said only "author".
- jedisct1 9y ago
  I can't work on both simultaneously. As libsodium has become pretty much feature complete, and much more bloated that I initially wanted, I am now refocusing more on hydrogen. Since this is relevant to the original topic, the password hashing API is a good illustration of the difference between both libraries. New additions to libsodium must remain consistent with historic APIs, that have limitations and usability issues. Hydrogen learned from this, and tries to model its API after common problems to solve in real-world applications rather than provide interfaces to cryptographic primitives. This will eventually become the base of libsodium 2.x Of course, there's nothing wrong with using libsodium, if only because it's way more mature and implements conservative designs that you can trust. But feedback on Hydrogen would also be really great. I really want to avoid doing the same mistakes again, and build the best possible easy-to-use hard-to-misuse APIs that everybody can use confidently.
  - LaGrange 9y ago
    Ah. Khm. Now I looked at the username blushes. Um, TBH if I didn't read you here I'd assume the line in "non-goals" means you actively don't want me to use it in pretty much anything I ever do, and follow that. I'd probably have to roll my own binding anyway, but now I'll at least pay attention.