5 ms·
I am surprised nobody had already talked about scrypt yet. Here is an old hackernews entry about it. http://news.ycombinator.com/item?id=601408 http://news.yco
by yogsototh 15y ago
I am surprised nobody had already talked about scrypt yet. Here is an old hackernews entry about it.
http://news.ycombinator.com/item?id=601408 http://news.ycombinator.com/item?id=601408
I would have loved to use scrypt, but there is only a C implementation. I would had loved to have at least a javascript one.
- JoachimSchipper 15y agoJavascript? Have fun securing that one against timing attacks. Also, it's so much slower than the C implementation (remember that crypto algorithms are very carefully designed for 32- or 64-bit words or arbitrary-length integers; Javascript's doubles are a very poor match.)
- SamReidHughes 15y agoTiming attacks are not a problem if you're using it to hash passwords. Also, Javascript implementations don't use doubles for pure integer arithmetic.
- JoachimSchipper 15y agoIf I can observe your (SSL-encrypted) login session, I can time how long the server takes to process your (presumably real) password. What makes you think password hashes don't need to worry about this?
- JonnieCache 15y agoWould you really be able to do timing attacks on a server from the client side? I thought you needed a much greater accuracy of measurement, sub-millisecond, than you would be able to achieve with network latency in the mix.
- VBprogrammer 15y agoApparently it can be done. http://www.cs.cmu.edu/~dbrumley/pubs/openssltiming.pdf http://www.cs.cmu.edu/~dbrumley/pubs/openssltiming.pdf
- daeken 15y agoUnless the user is logging in 10000 times in a row, how do you plan to get enough data?
- roel_v 15y agoBut it would only reveal the size of the password, and you'd need to know the work factor, or the other way around, right? Or am I understanding it wrong?
- SamReidHughes 15y agoDoh! To answer your question, probably the fact that it was late, or that I'm an idiot.
- dchest 15y agoI have to point out the slowness of JavaScript is real in this case. PBKDF2-HMAC-SHA256 with 5000 iterations (and scrypt uses PBKDF2 on input and output of a memory-hard function) takes ~2 sec. on my machine in Chrome. Even new typed arrays are not very helpful. This means that you essentially have to make your KDF's workload much weaker than if you used C implementation to get an acceptable performance.