4 ms·
Have you considered using BCrypt instead of SHA?
by jrs235 14y ago
Have you considered using BCrypt instead of SHA?
- enoch_r 14y agoDefinitely, but the CryptoJS library just seemed more mature than the Javascript BCrypt library I found, so I decided to just repeatedly hash the data to approximate BCrypt's work factor. Thanks!
- cheald 14y agoOne very large appeal of bcrypt is its memory usage characteristics. SHA1 is easily done on GPUs, and can be massively parallel with very little work. Simply rehashing doesn't adequately replicate the barriers that bcrypt puts in place to brute-forcing. See: http://crypto.stackexchange.com/questions/400/why-cant-one-implement-bcrypt-in-cuda http://crypto.stackexchange.com/questions/400/why-cant-one-i...
- enoch_r 14y agoThank you for that fascinating link. I've never understood why, if bcrypt is good because it's slow, a similarly slow implementation of SHA wouldn't be just as effective. Now I do. Really appreciate it!