4 ms·
I'm not sure what you mean, do you mean something like Bcrypt on its own isn't enough for password hashes? My understanding is that for password hashing you wa
by penagwin 7y ago
I'm not sure what you mean, do you mean something like Bcrypt on its own isn't enough for password hashes?
My understanding is that for password hashing you want two things - cryptographic security (can't go from hash -> password by attacking the algorithm ) - and you want it to be "as slow as is usable" to counter brute force attacks? Also per-password salts like bcrypt uses counters rainbow attacks don't hurt.
What else do you need to do to keep it secure ?
- lisper 7y agoThere are two different kinds of cryptographic hashes. It's confusing because there isn't standard terminology to distinguish between them, so I'm just going to call them Type 1 and Type 2. Type 1 hashes are designed to be fast and Type 2 hashes are designed to be slow. MD5, SHA, and Blake are Type 1 hashes. Bcrypt is a type 2 hash, as is PBKDF. Type 2 hashes are built using Type 1 hashes as components. Type 2 hashes also typically include additional features like salts that Type 1 hashes do not have.
- rurban 7y agoAnd there's the third and most important property: constant time. timing resistant. Usually not too fast and not too slow, but always in the same speed for each input. no shortcuts.
- lisper 7y agoNo, hashes do not need to be constant time because they aren't keyed. In fact, they cannot be constant time because they have to handle arbitrary-length input.
- garmaine 7y agoIf your hash was not constant-time and constant-power, you could work out what was hashed via precise timings or power readings.
- lisper 7y agoNo.
- garmaine 7y agohttps://en.wikipedia.org/wiki/Timing_attack https://en.wikipedia.org/wiki/Timing_attack https://crypto.stackexchange.com/questions/14681/attacking-hashed-password-by-timing-attack-and-other-means https://crypto.stackexchange.com/questions/14681/attacking-h... https://www.eng.tau.ac.il/~yash/C2_039_Wool.pdf https://www.eng.tau.ac.il/~yash/C2_039_Wool.pdf
- lisper 7y agohttps://en.wikipedia.org/wiki/Gish_gallop https://en.wikipedia.org/wiki/Gish_gallop The first two references you cite are attacks against a password hash. Blake3 is not a password hash, it is a general-purpose hash. The third reference is not an attack on the hash function timing, it is an attack against hash table timing, which is not at all the same thing. From the abstract: "Our attack does not rely on any weakness of a particular hash function and can work against any hash." Once again: Blake3 is a general-purpose hash, not a password hash. General-purpose hashes cannot be constant-time because they must operate on inputs of arbitrary length.
- garmaine 7y agoThen I think you misunderstood rurban's post. He's saying it is a property cryptographic hash functions must have that they are constant time, constant power. Yes, all cryptographic hashes suitable for general-purpose use have this property. That's part of why they are good general-purpose hash functions. And each round of Blake3 is constant-time, irrespective of input. We're talking about rounds (or, alternatively, constant-time for equivalent length input).
- deleted 7y ago[deleted]
- garmaine 7y agoThe term you are looking for is “key derivation function.”