4 ms·
Storing password securely - hashses, salts and bit stretching put into context
- ibotty 14y agonice summary. it is missing sha-crypt though.
- tedunangst 14y agoIs sha-crypt different in a meaningful way from md5-crypt except spelled a little differently?
- ibotty 14y agoehm. yes. (to say something substantial: see http://www.akkadia.org/drepper/SHA-crypt.txt http://www.akkadia.org/drepper/SHA-crypt.txt)
- tantalor 14y agoSee http://en.wikipedia.org/wiki/Application-specific_integrated_circuit http://en.wikipedia.org/wiki/Application-specific_integrated... (ASIC)
- tptacek 14y agoThat table in Colin's paper is so great. Here's a direct link to just the table: http://yfrog.com/j248cp http://yfrog.com/j248cp
- tedunangst 14y agobcrypt was introduced at usenix in 1999, though the source was committed in 1997. Not 2002. The article links to some random utility called bcrypt that is completely unrelated to the bcrypt password hashing function.
- 16s 14y agoWhen I think of bcrypt, I think of OpenBSD Blowfish hashes. I hate cracking those damn things. ;)
- thierryzoller 14y agoThanks, I updated the post.
- 16s 14y agoMicrosoft Active Directory servers store passwords as plain MD4 hashes and have done so for more than a decade and will likely continue to do so for another decade. http://16s.us/ms_ad_hashes/ http://16s.us/ms_ad_hashes/
- peteretep 14y agoFor the love of God, please switch off "mobile enhanced" versions of your blog. You can't pan around to view the tables because that switches to another article, complete with sparkly transition