4 ms·

It's a strange title, given that towards the end it seems more like he's recommending to not bother migrating from bcrypt to scrypt (if you're already using bcr

by csirac2 12y ago

It's a strange title, given that towards the end it seems more like he's recommending to not bother migrating from bcrypt to scrypt (if you're already using bcrypt). But now I'm curious: the author states that neither scrypt or PBKDF2 are really designed for password storage. Can anyone explain how a construction designed for this purpose would differ? Edit: I get that one of the goals for a KDF is to securely hash/expand a short input (password) of N bits out to something potentially >> N bits; and in the case of scrypt, do it in a way that's expensive for bruteforcers but acceptable for authentication. Is the reason scrypt/PBKDF2 aren't for password "storage" simply because they're not usable as such OOB (missing salt handling which bcrypt gives you for free?)

timmclean 12y ago
KDFs are definitely suitable for password storage, so I'm pretty confused at how the author arrived at their conclusion. They mention that scrypt with low security params is less secure than bcrypt at an adequate security setting. This doesn't seem particularly alarming or even surprising. I think a better take away would be: "If you use scrypt, make sure you choose adequate security parameters. If you're already using bcrypt, there's no need to switch to scrypt." Edit: the first paragraph of the scrypt paper actually brings up the fact that the problems of password storage and key derivation are equivalent: Password-based key derivation functions are used for two primary purposes: First, to hash passwords so that an attacker who gains access to a password file does not immediately possess the passwords contained therewithin; and second, to generate cryptographic keys to be used for encrypting and/or authenticating data. While these two uses appear to be cryptologically quite different [...] they turn out to be effectively equivalent https://www.tarsnap.com/scrypt/scrypt.pdf https://www.tarsnap.com/scrypt/scrypt.pdf

by csirac2 12y ago

timmclean 12y ago

KDFs are definitely suitable for password storage, so I'm pretty confused at how the author arrived at their conclusion. They mention that scrypt with low security params is less secure than bcrypt at an adequate security setting. This doesn't seem particularly alarming or even surprising. I think a better take away would be: "If you use scrypt, make sure you choose adequate security parameters. If you're already using bcrypt, there's no need to switch to scrypt." Edit: the first paragraph of the scrypt paper actually brings up the fact that the problems of password storage and key derivation are equivalent: Password-based key derivation functions are used for two primary purposes: First, to hash passwords so that an attacker who gains access to a password file does not immediately possess the passwords contained therewithin; and second, to generate cryptographic keys to be used for encrypting and/or authenticating data. While these two uses appear to be cryptologically quite different [...] they turn out to be effectively equivalent https://www.tarsnap.com/scrypt/scrypt.pdf https://www.tarsnap.com/scrypt/scrypt.pdf