3 ms·

Are you saying the auditors are the bureaucracy or the FIPS standards approvers are the bureaucracy? All the auditors are saying is that you have to use a FIPS

Are you saying the auditors are the bureaucracy or the FIPS standards approvers are the bureaucracy? All the auditors are saying is that you have to use a FIPS approved algorithm. The FIPS people have real cryptography experts who research this stuff on a daily basis that also help set the security standards for the entire U.S. government. The author is coming along here saying they are using something else that’s not approved by FIPS (for good reason I might add) and they’re mad the auditors won’t let them simply because “everyone else is using bcrypt”.

TimTheTinker 6y ago
> Are you saying the auditors are the bureaucracy or the FIPS standards approvers are the bureaucracy? Both. > All the auditors are saying is that you have to use a FIPS approved algorithm. ... which is a problem, because FIPS approved doesn’t imply secure. Bcrypt is a better password hashing algorithm than any FIPS-approved algorithm at this time. Don’t agree with me? Read up on it. I’m not necessarily recommending it though - there are others that may be even better, depending on the circumstance. > they are using something else that’s not approved by FIPS (for good reason I might add) What reason? Is there an expert cryptographer’s opinion or any expert cracking reports you can reference? Just because a group of experts decided a certain list of algos were “approved” several years ago doesn’t mean that newer algos designed or popularized since then are less secure. Authority alone doesn’t confer reality or truth. And unlike compliance, security is a process, not a destination.