4 ms·
Sounds like OpenSSL's 'PKCS5_PBKDF2_HMAC_SHA1' is the 'officially standard' way to make a key from a password, am i on the right track?
by chubs 15y ago
Sounds like OpenSSL's 'PKCS5_PBKDF2_HMAC_SHA1' is the 'officially standard' way to make a key from a password, am i on the right track?
- marshray 15y agoYes, that sounds great. SHA-1 is officially deprecated, but there aren't known weaknesses with using it in PBKDF2 and HMAC. Still, prefer SHA-2 ("SHA-256" or "SHA-512") if it's available. Be sure you specify an iteration count high enough to consume noticeable time (it should hurt a little bit) and store that count with the salt.
- chubs 15y agoThanks a lot! Very helpful. I'll use that then, since it's part of openssl - then i can claim rightly that i use industry standard crypto, rather than my bcrypt/sha256 mashup that i dreamt up myself.