4 ms·
The bit about "HTTP connections being simulated by sleep()" was just a cynical hypothesis in which users might have perceived a hardness benefit (rounds of a KD
by scott_karana 12y ago
The bit about "HTTP connections being simulated by sleep()" was just a cynical hypothesis in which users might have perceived a hardness benefit (rounds of a KDF) that was actually just latency (round trip). I'll edit my post to make that more clear.
As for the offline attack: I agree, and thought I addressed it in the first point:
Adding rounds to your already existing secure hash doesn't require any SaaS assistance. It simply requires increasing your "rounds" field.
- chias 12y agoAh, I misunderstood your intention. That makes it clearer to me, thanks :) And I agree with you fully, in particular that this idea doesn't increase the guarantees or cryptographic assurances that you have in any real way. Then again I could envision it as being useful if you're stuck in a particular situation in which your use of hash function is mandated by something out of your control. If I was forced to use plain SHA1 (or god help me, MD5) for handwavy legacy reasons, throwing something like this in might help me sleep better at night. Would I ever use it? Probably not. But I think it's a cute hack that could be useful under the right (wrong?) circumstances.