4 ms·

Why would you use this "poor man's approach" over bcrypt or scrypt? My understanding is that these two work on a very similar concept (work factor) and are free

Why would you use this "poor man's approach" over bcrypt or scrypt? My understanding is that these two work on a very similar concept (work factor) and are free to use.

csytan 16y ago
I can think of one reason: Lack of the available libraries on a particular platform.
- timtadh 16y ago
  This is why I mentioned it. It provides improved time guarantees for your users with out needing another library.
- paperclip 16y ago
  bcrypt is open source and ported to a range of operating systems. I cannot imagine getting it up and running on any system would be too difficult. It would probably be wiser to to spend the time to get bcrypt (or another standard scheme) working rather than coming up with some custom scheme which probably hasn't had the same level of thought put into it.
jrockway 16y ago
Because building your own square-shaped wheel is more fun than talking a walk over to your friendly neighborhood wheel store and buying a round one?
burgerbrain 16y ago
Because we all know rolling your own in the crypto world instead of deferring to the experts never leads to catastrophe!
- brown9-2 16y ago
  You assume those are the only two choices, I was considering that in some environments these might be the only two choices when I asked the question.
ams6110 16y ago
Some projects require FIPS 140-2 compliance. I've not been able to find that blowfish or bcrypt are certified. See http://csrc.nist.gov/publications/fips/fips140-2/fips1402annexa.pdf http://csrc.nist.gov/publications/fips/fips140-2/fips1402ann...
- deleted 16y ago
  [deleted]
- burgerbrain 16y ago
  If a randomly clobbered together and unvetted system is compliant, but bcrypt isn't, that just goes to show how little FIPS140-2 compliance actually means. (as if everybody didn't already know it's worthless)
  - ams6110 16y ago
    Nonetheless, some projects mandate use of FIPS 140-2 hashing algorithms, and afaik bcrypt is not one. So if you find yourself on such a project, bcrypt is not an option on the table. I'd be happy to find out I'm wrong.

Why would you use this "poor man's approach" over bcrypt or scrypt? My understanding is that these two work on a very similar concept (work factor) and are free to use.

csytan 16y ago

I can think of one reason: Lack of the available libraries on a particular platform.

timtadh 16y ago
This is why I mentioned it. It provides improved time guarantees for your users with out needing another library.
paperclip 16y ago
bcrypt is open source and ported to a range of operating systems. I cannot imagine getting it up and running on any system would be too difficult. It would probably be wiser to to spend the time to get bcrypt (or another standard scheme) working rather than coming up with some custom scheme which probably hasn't had the same level of thought put into it.

jrockway 16y ago

Because building your own square-shaped wheel is more fun than talking a walk over to your friendly neighborhood wheel store and buying a round one?

burgerbrain 16y ago

Because we all know rolling your own in the crypto world instead of deferring to the experts never leads to catastrophe!

brown9-2 16y ago
You assume those are the only two choices, I was considering that in some environments these might be the only two choices when I asked the question.

ams6110 16y ago

Some projects require FIPS 140-2 compliance. I've not been able to find that blowfish or bcrypt are certified. See http://csrc.nist.gov/publications/fips/fips140-2/fips1402annexa.pdf http://csrc.nist.gov/publications/fips/fips140-2/fips1402ann...

deleted 16y ago
[deleted]
burgerbrain 16y ago
If a randomly clobbered together and unvetted system is compliant, but bcrypt isn't, that just goes to show how little FIPS140-2 compliance actually means. (as if everybody didn't already know it's worthless)
- ams6110 16y ago
  Nonetheless, some projects mandate use of FIPS 140-2 hashing algorithms, and afaik bcrypt is not one. So if you find yourself on such a project, bcrypt is not an option on the table. I'd be happy to find out I'm wrong.