Re:Introduction to GPU Password Cracking: Owning the LinkedI...
by ralala on Monday June 20, 2016 @06:19PM
(#11942037)
What are the advantages of bcrypt compared to SHA based hashes with unique salts?
[ Parent
| on HN ]
Re:Introduction to GPU Password Cracking: Owning the LinkedI...
by niftich on Monday June 20, 2016 @06:39PM
(#11942161)
General-purpose cryptographic hash functions like the (now-broken) MD5, SHA1, SHA256, etc. are designed to be computationally easy, ie. fast.
Salting protects against rainbow tables [1], but it doesn't change the fact that computing a SHA256 hash is fast.
Password hash functions like PBKDF2, bcrypt, scrypt, Argon2 are designed to be computationally expensive, to make a password-cracking endeavor take even longer.
Argon2, the winner of the Password Hashing Competition and the current state-of-the-art, for example, has two ready-made variants: Argon2d is more resistant to GPU cracking, while Argon2i is more resistant to time-memory tradeoff attacks [2].
Re:Introduction to GPU Password Cracking: Owning the LinkedI...
by bigiain on Monday June 20, 2016 @09:40PM
(#11942938)
bcrypt is significantly slower to compute. Something like 5 or 6 orders of magnitude slower. (se my other comment in here with numbers for cracking various hash types on an 8gpu rig...)
Re:Introduction to GPU Password Cracking: Owning the LinkedI...
by ralala on Tuesday June 21, 2016 @03:43AM
(#11944114)
Can I achieve the same by applying SHA x times?
Re:Introduction to GPU Password Cracking: Owning the LinkedI...
by Ambroos on Tuesday June 21, 2016 @04:16AM
(#11944268)
If X is millions (or even billions), maybe, but you shouldn't. Just use one of the real password algorithms. Never ever roll your own hashing system assuming it's secure enough. It won't be.