3 ms·
why does concatenating bcrypt(salt, pw) with HMAC(salt, pw) make guessing fast? Intuitively it seems like you'd still need to guess the bcrypt portion, making
by nialo 12y ago
why does concatenating bcrypt(salt, pw) with HMAC(salt, pw) make guessing fast?
Intuitively it seems like you'd still need to guess the bcrypt portion, making it no worse than just bcrypt.
- euank 12y agoWhy not just ignore the bcrypt portion? "Intuitively" it seems to me like you could just un-concatonate the two strings and guess at them separately, working on whichever you know to be easier.