3 ms·
True true, all of them are better than just salted hashes. It is much harder to brute-force bcrypt and scrypt in hardware (ASIC, GPUs, etc...). It's just impo
by kyrra 14y ago
True true, all of them are better than just salted hashes. It is much harder to brute-force bcrypt and scrypt in hardware (ASIC, GPUs, etc...).
It's just important to understand the differences and trust behind the different algorithms. PBKDF2 is NIST recommended, which I would say speaks to its strength (unlikely it will be easily cracked). It can also be used with any input size. Though, calculation requires little memory, so it can easily be implemented in hardware.
bcrypt has been around since 1999 has is still going strong, but is limited to input sizes of 55-characters.
scrypt is fairly new and I don't feel has been wrong long enough to be vetted by the security community.
- tptacek 14y agoYou say it's "unlikely it will be easily cracked", but, obviously, it's demonstrably easier to crack than bcrypt and scrypt.
- kyrra 14y agoSHA-1 and SHA-256 use 32-bit word sizes which makes them very easy to implement on current GPUs. CUDA and OpenCL allow for computation on 32-bit floats very quickly, but neither can easily do 64-bit floats right now. Which is why I said originally that SHA-512 would be preferable right now (due to 64-bit word sizes for its keys). I don't follow GPU tech enough to know if they plan on implementing 64-floats any time soon, so commodity hardware to easily brute-force SHA-512 may not be around for a while. Though, they can still implement SHA-512 calculations on a GPU a lot easier than they can for scrypt or bcrypt. Now, if you use PBKDF2 with a large iteration count (lets say 20000), it will make the time to calculate the final solution a lot harder. You could give an iteration count to PBKDF2 to have it take the same amount of time as bcrypt would take to run. The only thing you can't do with PBKDF2 is adjust the amount of memory required to calculate the solution.
- tptacek 14y agoThough, they can still implement SHA-512 calculations on a GPU a lot easier than they can for scrypt or bcrypt.
- rorrr2 14y ago> bcrypt has been around since 1999 has is still going strong, but is limited to input sizes of 55-characters You can SHA512 the password before feeding it to bcrypt if that's an issue. 55 character passwords cannot be brute forced anyway.