4 ms·

Security margins here (IE: bcrypt versus SHA-2) are estimated with entropy, which is also completely missing in the article. A weak password is a weak password,

Security margins here (IE: bcrypt versus SHA-2) are estimated with entropy, which is also completely missing in the article. A weak password is a weak password, bcrypt or not. If there is sufficient entropy behind the password, 500,000 rotations of SHA-512 is not "weaker" than bcrypt, Only faster. You should know this (weird that I had to say that).

ghshephard 12y ago
Speeding up your password hash mechanism makes it weaker. The faster your password hash system, the more quickly your password list can be broken. This is probably the best commentary I've seen on the topic of how many rounds you should incorporate into your KDF (Scrypt/Bcrypt/PBKDF2 all let you dial as many as you wish), so I won't try and improve on it: http://security.stackexchange.com/a/3993 http://security.stackexchange.com/a/3993
- atoponce 12y ago
  You're overlooking the entropy behind the hash though. If entropy is sufficient for creating the password (120-bits or so), no matter of brute force speed will recover the text that created the hash. You'll instead need to break the hashing algorithm itself. The math is against you.
  - deleted 12y ago
    [deleted]
  - ghshephard 12y ago
    If you have 120 bits of entropy, then a single round of unsalted SHA-2 is sufficient. If you have typical users, with typical user passwords, then take a few minutes to read through: http://security.stackexchange.com/a/3993 http://security.stackexchange.com/a/3993 (it discusses the importance of taking into account entropy) to determine what work factor is appropriate for your situation, then just deploy one of scrypt/bcrypt/PBKDF2 with that work factor.
    - tptacek 12y ago
      Yes. The basic job of a password hash is to improve the security of low-entropy secrets. The argument here seems to be that if people simply don't use passwords, but instead secure AES keys, password hashes won't matter. Ok, but we're talking about passwords, and so was he, upthread.
copsarebastards 12y ago
> If there is sufficient entropy behind the password, 500,000 rotations of SHA-512 is not "weaker" than bcrypt, Only faster. Given that the strength of security is measured in how long it takes to break it, and hash time is directly correlated with brute force time, for the same password, faster is weaker. Having high-entropy passwords certainly increases security, but it's a well-known fact that users don't use high-entropy passwords, so that's pointless to talk about.

ghshephard 12y ago

Speeding up your password hash mechanism makes it weaker. The faster your password hash system, the more quickly your password list can be broken. This is probably the best commentary I've seen on the topic of how many rounds you should incorporate into your KDF (Scrypt/Bcrypt/PBKDF2 all let you dial as many as you wish), so I won't try and improve on it: http://security.stackexchange.com/a/3993 http://security.stackexchange.com/a/3993

atoponce 12y ago
You're overlooking the entropy behind the hash though. If entropy is sufficient for creating the password (120-bits or so), no matter of brute force speed will recover the text that created the hash. You'll instead need to break the hashing algorithm itself. The math is against you.
- deleted 12y ago
  [deleted]
- ghshephard 12y ago
  If you have 120 bits of entropy, then a single round of unsalted SHA-2 is sufficient. If you have typical users, with typical user passwords, then take a few minutes to read through: http://security.stackexchange.com/a/3993 http://security.stackexchange.com/a/3993 (it discusses the importance of taking into account entropy) to determine what work factor is appropriate for your situation, then just deploy one of scrypt/bcrypt/PBKDF2 with that work factor.
  - tptacek 12y ago
    Yes. The basic job of a password hash is to improve the security of low-entropy secrets. The argument here seems to be that if people simply don't use passwords, but instead secure AES keys, password hashes won't matter. Ok, but we're talking about passwords, and so was he, upthread.

copsarebastards 12y ago

> If there is sufficient entropy behind the password, 500,000 rotations of SHA-512 is not "weaker" than bcrypt, Only faster. Given that the strength of security is measured in how long it takes to break it, and hash time is directly correlated with brute force time, for the same password, faster is weaker. Having high-entropy passwords certainly increases security, but it's a well-known fact that users don't use high-entropy passwords, so that's pointless to talk about.