9 ms·
What's wrong with PBKDF2-SHA256? I use PBKDF2-HMAC-SHA256 for an almost-stateless password manager.
by dheera 6y ago
What's wrong with PBKDF2-SHA256? I use PBKDF2-HMAC-SHA256 for an almost-stateless password manager.
- deleted 6y ago[deleted]
- kaiju0 6y agoSHA and MD are fast hashers. You want slow hashers for password security like b-crypt and s-crypt.
- dheera 6y agoDoesn't PBKDF2 fix that as long as you use a very large number of irritations?
- sneak 6y agoIn theory, absolutely. In practice, bitwarden's server limits the max iteration count on a user account to something that remains insecure. They refuse to fix it. https://github.com/bitwarden/server/issues/589 https://github.com/bitwarden/server/issues/589
- Shoop 6y agoWhat do you think about this reply on that thread? https://github.com/bitwarden/server/issues/589#issuecomment-751418282 https://github.com/bitwarden/server/issues/589#issuecomment-...
- batrat 6y agoFor me is not a big deal. If your password is Hunter22 than you have bigger problems than PBKDF. It doesn't matter if they PBKDF it 30 milion times. Longer passwords are harder to crack and I still don't understand why people not using passphrases in their passwords. Having 2fa enabled on all other accounts it makes me sleep better if somehow one day BW or any other password manager gets compromised.
- Harvesterify 6y agoUse a longer and more complex master password. You're welcome.
- sneak 6y agoYou're the sixth person to reply to me with this "advice". My own password is 30 characters and I self-host bitwarden_rs, patched to permit a higher KDF iteration count. This has nothing to do with my usage.
- the_mitsuhiko 6y agoEvidently there is no problem then.
- luis8 6y agoIs sharing you password length wise? Knowing the # of chars you have reduced the number of iterations needed to complete a brute force attack. 255! vs 255! / (255 - 30)! My math could be off though, i haven't work with factorials since i was in the university
- throwaway744678 6y agoIt's a trick. OP's password is actually 29 chars long, but the attacker will now start at 30 characters, and never brute force the actual password. Nicely played.
- Dylan16807 6y agoI don't think you want a factorial involved. With unknown size, cracking 30 characters takes time proportional to n^30 + n^29 + n^28 etc. Cracking just 30 is proportional to n^30. The difference is negligible. A percent or two.
- luis8 6y agoMy bad, I was thinking in permutations but those does not allow repeated entries. It make sense now, like you said the difference is negligible.
- user5994461 6y agoPBKDF2 is a slow algorithm specifically created for password hashing. It's in the same family as bcrypt and scrypt.
- px43 6y ago> PBKDF2 is a slow algorithm specifically created for password hashing. Yeah, over 20 years ago. It's woefully out of date by modern standards. PBKDF2 doesn't even attempt memory hardness, so there are whole classes of attacks on later generation slow hashing algorithms that don't even apply to PBKDF2 because of how old it is. Argon2 is extremely resistant to Time-Memory-Trade-Off (TMTO) attacks, which older algorithms like bcrypt and scrypt are vulnerable to. PBKDF2 is essentially a linear slowdown, which is effectively pointless these days.
- user5994461 6y agoMath doesn't age. Cheers. bcrypt and scrypt, the successors to PKDF2, are both more than a decade old. RSA is half a century old and it's still up to date by modern standards. In fact nobody has came up with anything better. Edit: Actually, bcrypt might be as far as 1999, possibly older than PBKDF2.
- goalieca 6y ago> RSA is half a century old and it's still up to date by modern standards. In fact nobody has came up with anything better. RSA is currently a minefield of gotchas and few security companies even get it right. Just generating a good key is actually a very difficult task. It is also very computationally slow and has many practical issues for the level of security it provides. There are many superior replacements in both pqc and elliptic spaces. I would take EdDSA over rsa-pss any day of the week.
- user5994461 6y agoRSA is extremely simple, it's just multiplications and powers. It can be reasonably explained to high school students. The tooling is mature and keys are trivial to generate safely with a openssl command. EdDSA is another level entirely. I don't know how you can recommend elliptic curve cryptography with a straight face if you think RSA is hard. P.S. It's a myth that EdDSA is faster. This depends on operation (signing vs verification) and key size.
- est31 6y agoThe advantage of algorithms like Argon2 is that they are way harder to implement scalably in hardware than SHA256 is. Or in other words, it's easy to build an ASIC that's 1000x as powerful to compute SHA256 hashes as a recent Intel CPU than to build something that's 1000x as powerful to compute Argon2 hashes. You might still be able to, but then power usage is hopefully closer to a 1000-fold of the Intel CPU than the SHA256-ASIC is.
- SAI_Peregrinus 6y agoIt's not memory-hard. That makes it much, much faster on GPUs than CPUs, which tends to mean it's much faster for attackers than legitimate users. It's also likely vunlerable to side-channel attacks, since nothing in its design tries to resist those. It's not broken by any means, and still vastly better than just a salted cryptographic hash, but it's not as good as Argon2id.
- alserio 6y agoIf I may ask a question: how would I use a memory hardened algorithm on a server if the server ram can't scale infinitely? It seems to me that a few concurrent user logins would effectively DOS the server for any reasonable configuration of argon2
- SAI_Peregrinus 6y agoYou don't actually need it to use that much RAM. It's more about memory bandwidth. An attacker can increase the memory bandwidth by using block RAM like in an FPGA or on-die RAM in an ASIC, but both of those are far more expensive than discrete DDR DRAM modules. So with appropriate memory usage (enough to saturate the cache lines) it can be cheap enough for the server to run yet still more expensive to build an ASIC platform for. Of course an ASIC can use DDR as well, but then it's stuck with the same memory bandwidth as the DDR module and gains no particular advantage. Argon2id with t=3, m=92MiB, p=1 should be slower than bcrypt with cost 12 on most modern GPUs. That's not actually all that much memory, you can handle quite a few concurrent logins on a server with those settings. 10 concurrent logins per GiB of RAM dedicated to the task. And it should only DOS the login process, so it might make taking out your auth process (or server) easier but won't necessarily harm any other part of the site.
- alserio 6y agoThank you. I find a GiB for 10 concurrent logins still a bit too much for some use cases but you have given me a better understanding of the trade-off involved.
- __s 6y agoRead the opening comment on the issue It's reasonable to expect an attacker to have a SHA256 ASIC given Bitcoin making those a commodity Potentially this can be offset if your server has https://en.wikipedia.org/wiki/Intel_SHA_extensions https://en.wikipedia.org/wiki/Intel_SHA_extensions but if you're running on cell phones that's not there See also https://bitcoin.stackexchange.com/questions/36253/what-mining-performance-can-we-roughly-expect-from-the-intel-sha-extensions-of-t https://bitcoin.stackexchange.com/questions/36253/what-minin...