3 ms·
Still a difference between "you'll be fine" and "if you're newly choosing, might as well not pick PBKDF2 where anyone with a regular GPU gets a 100x speedup com
by Aachen 2y ago
Still a difference between "you'll be fine" and "if you're newly choosing, might as well not pick PBKDF2 where anyone with a regular GPU gets a 100x speedup compared to your server CPU". Bcrypt wasn't even designed for memory hardness but is so much more annoying to crack because it seems to stress (per my understanding) the GPU's memory bus just enough with the iirc 4k state table that's being randomly accessed
- layer8 2y agoIn the browser, PBKDF2 can still make sense, because all modern browsers support it via SubtleCrypto.deriveKey(), and you may want to avoid the overhead of a JS-implemented alternative. Just select the maximum iteration count that is still acceptable for your use case and targeted devices (mobile devices tend to be the slowest).
- Aachen 2y agoVery true. May make sense to check how WASM implementations stack up, though. Makes me realise I don't even know if WASM does multithreading; maybe via background workers?