3 ms·
What were your timings like for bcrypt using 12 rounds? Also, while for the SHA-x algorithms, there have been numerous tests--what about for the pycrypt module
by ylem 16y ago
What were your timings like for bcrypt using 12 rounds? Also, while for the SHA-x algorithms, there have been numerous tests--what about for the pycrypt module?
- stevelosh 16y agoTimings are going to be completely dependent on the server. Anything I tell you will be wrong unless you're running on my server. And I didn't test any SHA-x algorithms. Any algorithm that has a time you can't easily increase by tweaking a number (BCRYPT_ROUNDS) will eventually become insecure as computers get faster.
- JoachimSchipper 16y agoIt's not straight SHA-x, I'd wager; glibc includes a version of phk's MD5-based crypt() based on SHA2 (with some bonus insanity thrown in; it's a spawn of MD5 crypt and Drepper, after all.) Like md5crypt, this new crypt() is not based on established cryptographic principles.