4 ms·
Repeating a SHA-256 (or other hash) many times is essentially what PBKDF2 is. Though since 100 million SHA-256/sec is apparently doable on GPUs, even with 100,
by derobert 15y ago
Repeating a SHA-256 (or other hash) many times is essentially what PBKDF2 is.
Though since 100 million SHA-256/sec is apparently doable on GPUs, even with 100,000 rounds, you currently need at least an 8-character random password to be secure from someone attacking without much budget.
- lvh 15y agoYes, I know -- the question stands: why would you have both of these concurrently in the same system? Either you want a KDF, or you don't want a KDF -- pick one, and don't start reinventing your own (potentially poorly), please :-(