5 ms·
>> don’t use SHA256 for password hashing, use some algorithm that is designed to be slow (like bcrypt or scrypt) to make offline password cracking even more dif
by ianbishop 17y ago
>> don’t use SHA256 for password hashing, use some algorithm that is designed to be slow (like bcrypt or scrypt) to make offline password cracking even more difficult. (dedicated hardware for SHA256 is really fast)
Has anyone ever actually bothered to try implementing something like this over SHA/MD5?
- jrockway 17y agoUh, yes? Here's how I implement salted digests: my $p = Authen::Passphrase::SaltedDigest->new( algorithm => "SHA-1", salt_random => 1, passphrase => "passphrase", ); $p->to_rfc2307; Here's how I implement bcrypt: my $p = Authen::Passphrase::BlowfishCrypt->new( cost => 8, salt_random => 1, passphrase => "passphrase", ); $p->to_rfc2307; I save that $p->to_rfc2307 string to the database. When I want to verify the password, I don't have to worry about the algorithm in use, I just say: my $p = Authen::Passphrase->from_rfc2307( <whatever> ); $p->check_passphrase("passphrase") # returns true or false Polymorphism is a wonderful thing. If I started using a salted digest and later wanted to switch to bcrypt, I could easily do that. But of course, I always just start with bcrypt. (There is other nice stuff, like a passphrase that never returns true from check_passphrase, for disabling accounts; and a subclass that stores the password in cleartext, for debugging.) I am really shocked that a web framework like Rails requires you to do the salting manually. I wonder how many people, like the Perlmonks folks, got it completely wrong.
- cschneid 17y agoRails doesn't do anything password related for you. The common authentication libraries (plugins) do salt the passwords for you.