4 ms·
There are two principal benefits of sticking with PBKDF2: 1) It's a NIST standard. This may be necessary in some environments, typically just to check a box. (
by aaronmdjones 7y ago
There are two principal benefits of sticking with PBKDF2:
1) It's a NIST standard. This may be necessary in some environments, typically just to check a box. (Yeah, I know...)
2) It's necessary for SCRAM (RFCs 5802, 7677), which is a much better login method based on passwords. This is applicable if your system uses GSS-API or SASL (e.g. dovecot IMAP logins).
If neither applies, my advice is to migrate to Argon2.
- masklinn 7y agoAlso PBKDF2 is really easy to implement if you have a cryptographic hash (even more so with a ready-made HMAC), which is useful if you can't or don't want to pull in dependencies.