4 ms·
[EDIT: tptacek is right. Listen to tptacek.] PBKDF2 isn't necessarily better than bcrypt. But yes, it's a good choice.
by JoachimSchipper 14y ago
[EDIT: tptacek is right. Listen to tptacek.]
PBKDF2 isn't necessarily better than bcrypt. But yes, it's a good choice.
- tptacek 14y agoPBKDF2 is objectively worse than bcrypt, but the difference between them isn't meaningful. The only meaningful choice in password hashes is between PBKDF2/bcrypt and scrypt, which is hardened against gate-level-optimized attacks.
- pbsd 14y agoThey're not comparable: PBKDF2 is a mode of operation, bcrypt is an actual instantiation of a password hashing scheme. Saying one is (objectively) better than the other is meaningless, or at least very misleading.