2 ms·
The reason I would prefer it is that PBKDF2 is standardized in an RFC with proper test vectors an a reference implementation in C. Bcrypt and Scrypt do not. We
by marshray 15y ago
The reason I would prefer it is that PBKDF2 is standardized in an RFC with proper test vectors an a reference implementation in C.
Bcrypt and Scrypt do not. We could debate the relative quality of the cryptographers behind them all day, but realistically Bcrypt has had at least one widely-deployed implementation bug that caused a real decrease in strength which can be traced back to a lack of proper test vectors.
- tptacek 15y agoThat's because PBKDF2 is the result of a standards process, and bcrypt is the result of the Unix process (bcrypt is the extaction of OpenBSD's password hash function from the late '90s).
- marshray 15y agoJust to add to that, some common implementations of Bcrypt used by web apps are an extraction from the cracking tool John the Ripper.