2 ms·
I'm concerned that you advocate ignorance of 'salt'. Some functions[0][1] seem to optionally allow the use of salt, are you saying that users should just use p
by Joakal 15y ago
I'm concerned that you advocate ignorance of 'salt'.
Some functions[0][1] seem to optionally allow the use of salt, are you saying that users should just use passwords as input with bcrypt hashing?
In the article, it does not suggest only bcrypt as well [2].
[0] http://www.mindrot.org/projects/py-bcrypt/ http://www.mindrot.org/projects/py-bcrypt/
[1] http://au.php.net/crypt http://au.php.net/crypt
[2] http://www.usenix.org/events/usenix99/provos/provos_html/node16.html#SECTION00070000000000000000 http://www.usenix.org/events/usenix99/provos/provos_html/nod...
- tptacek 15y agoBcrypt uses a 128 bit salt. The code I provided above didn't show it, because the library simply generated it for me. The bcrypt libraries that require users to explicitly provide a salt are themselves doing their users a (slight) disservice, by making it seem as if there was a reasonable option for salt generation other than simply using a CSPRNG.
- djmdjm 15y ago> The code I provided above didn't show it, because the library simply generated it for me. ... and this is another reason why people should use one of the bcrypt() implementations for their language* - the API makes doing the wrong thing difficult or impossible. * disclosure: I ported/wrote a couple of them