3 ms·

We hash the password using pbkdf2. The actual code looks like this: crypto.pbkdf2(text, salt, ITERATIONS, BYTES, function... ITERATIONS is 1000, and BYTES is

• tptacek 12y ago
  That's great; it's the answer I quietly predicted I'd get. If you're communicating to laypeople, you can say something like "we use a modern secure password hash".
• zaroth 12y ago
  Note, if your crypto.pbkdf2() is using SHA1 underneath, then 1,000 interations of SHA1 is very little computation for a GPU, which can do billions of SHA1 per second. Also, asking for 32 bytes from PBKDF2-HMAC-SHA1 has some bad side-effects, particularly if you are splitting up the result. (1Password got bitten by this, and wrote up the issue here: http://blog.agilebits.com/wp-content/uploads/2013/07/playing-defense.pdf http://blog.agilebits.com/wp-content/uploads/2013/07/playing...)
  • tptacek 12y ago
    If by "bitten by this" you mean "had their security reduced by 1 bit", then sure.
    • zaroth 12y ago
      I remember it feeling like a bigger deal reading about it at the time, but as you say, you're just throwing away half of the stretching, reducing attack cost by half.