3 ms·
I've actually wanted to ask you about: https://news.ycombinator.com/item?id=8088253 https://news.ycombinator.com/item?id=8088253 but I cant reply yet. If that e
by chacham15 12y ago
I've actually wanted to ask you about: https://news.ycombinator.com/item?id=8088253 https://news.ycombinator.com/item?id=8088253 but I cant reply yet. If that ever actually became an issue, could it be solved by instead having the client send (2 ^ w) - 1 rounds of the hash and having the server do the last round? My reasoning is that the client would have to brute force the full hash space if they wanted to reverse only the last round instead of trying to brute force the password.
- nialo 12y agoone possible reason this doesn't work: A limit on the number of iterations for a password hash is the amount of latency the user is willing to accept, which is (approximately) constant regardless of whether those iterations are computed on the client or the server