4 ms·
Your comment that this is MD5 x 1000 is very informative and got me searching for the FreeBSD MD5 crypt function, and I found this gem from /usr/src/lib/libcryp
by snorkel 15y ago
Your comment that this is MD5 x 1000 is very informative and got me searching for the FreeBSD MD5 crypt function, and I found this gem from /usr/src/lib/libcrypt/crypt-md5.c:
/*
* and now, just to make sure things don't run too fast
* On a 60 Mhz Pentium this takes 34 msec, so you would
* need 30 seconds to build a 1000 entry dictionary...
*/
for(i = 0; i < 1000; i++) {
MD5Init(&ctx1);
if(i & 1)
MD5Update(&ctx1, (const u_char *)pw, strlen(pw));
...
... which seems to still be the default implementation in FreeBSD. I'd guess it's time to increase the iterations to 200000.
- arundelo 15y agoEase of increasing how long it takes to compute the hash is the main idea behind bcrypt: http://codahale.com/how-to-safely-store-a-password/ http://codahale.com/how-to-safely-store-a-password/
- benatkin 15y agoYeah, it's pretty easy to change this in Devise, a popular auth library for rails that uses bcrypt by default, and to have a custom value to speed up unit tests: https://github.com/plataformatec/devise/wiki/Speed-up-your-unit-tests https://github.com/plataformatec/devise/wiki/Speed-up-your-u... config.stretches = Rails.env.test? ? 1 : 10