4 ms·
If you're trying to make something in pure Lisp, your odds of failure are less if you take an existing hashing algorithm (e.g. SHA-256) and just iterate it a bu
by pjscott 16y ago
If you're trying to make something in pure Lisp, your odds of failure are less if you take an existing hashing algorithm (e.g. SHA-256) and just iterate it a bunch of times. Ironclad has SHA-256, so this is really easy:
(defun slow-hash (password salt &key (iterations 10000))
"Produces a 256-bit hashed value of password and salt, slowly. Uses
a tweakable number of iterations, which should not be less than
1000, and which defaults to 10000."
(let ((hash (ironclad:make-digest :sha256)))
;; First, hash the salt and password
(ironclad:update-digest hash
(ironclad:ascii-string-to-byte-array salt))
(ironclad:update-digest hash
(ironclad:ascii-string-to-byte-array password))
;; Repeatedly hash the hash, to slow things down
(dotimes (x iterations)
(ironclad:update-digest hash (ironclad:produce-digest hash)))
(ironclad:produce-digest hash)))
- koenigdavidmj 16y agoEven after one round, repeating that knocks down your plaintext-space to 256 bit strings (or however long the output is of the hash function that you are using). Tom/Colin, is this actually a problem?
- inklesspen 16y agoThat's the case for every hash function. If it's a good hash function, the outputs will be evenly distributed across the entire 256 bit space, which comes out to 2^256 possible outputs. I don't think this is a problem; bcrypt has a much smaller output space.