5 ms·
Can you saw which? Blowfish?
by EGreg 6y ago
Can you saw which? Blowfish?
- valauran 6y agoUse argon2 or scrypt for password hashing. PBKDF2 or bcrypt are also acceptable, but prefer the first two in new systems. Make sure to use appropriate complexity factors. A good starting point when trying to decide what crypto algorithm to use is https://latacora.micro.blog/2018/04/03/cryptographic-right-answers.html https://latacora.micro.blog/2018/04/03/cryptographic-right-a...
- JulianMorrison 6y agoI absolutely love that right answers document. Thank you.
- teddyh 6y agoPeople used to say “Just use bcrypt.”, but this might have changed since. A cursory look seems to indicate that Argon2 is the current preferred choice.
- tptacek 6y agobcrypt is fine. It has held up quite well. Really, when picking among the mainstream password hashes, just throw a dart if you need to.
- __s 6y agopbkdf2: https://en.wikipedia.org/wiki/PBKDF2 https://en.wikipedia.org/wiki/PBKDF2 Your standard crypto library probably implements it (Rfc2898DeriveBytes for .NET). Under the covers you should tell it to use SHA512. If you can choose something better go ahead, but this is often good enough
- deleted 6y ago[deleted]