3 ms·
I think we're saying basically the same thing. You're not criticizing the use of PBKDF2 as a bad choice as the parent comment implies.
by po 13y ago
I think we're saying basically the same thing. You're not criticizing the use of PBKDF2 as a bad choice as the parent comment implies.
- goblin89 13y agoI should've written “blindly recommending” instead of “recommending”. (That's the passage I was referring to: > If you're explaining crypto to a reader, and you're at the point where you're discussing KDFs, you'd think there'd be cause to explain that PBKDF2 is actually the weakest of those 3 KDFs, and why. Also, I'm not arguing the sanity of Django developers' choice of PBKDF2 as default password encryption mechanism—IMO marginally better security wouldn't be worth the increased complexity of starting new project for newcomers.)