NIST advises services to not require that passwords be changed periodically

Re:NIST advises services to not require that passwords be ch... by tptacek on Sunday May 21, 2017 @02:20AM (#14385948)

I like ChaCha. I like AES. Systems should choose one or the other. Part of the point of ChaCha is to exploit the capabilities of general-purpose processors to get fast encryption without special-purpose hardware acceleration.

What people should not do is cascade ciphers, or, even worse, build systems that allow for cipher negotiation. Every system that negotiates has been a disaster.

[ Parent | on HN ]

Re:NIST advises services to not require that passwords be ch... by LinuxBender on Sunday May 21, 2017 @12:29PM (#14387954)

If I were an intelligence agency or signal intelligence, I might argue for this so that I can narrow my attacks to one cipher. Perhaps the mafia or cartel would benefit from this. I can't imagine any other rational to argue for standardizing on a single cipher.

[ Parent | on HN ]

Re:NIST advises services to not require that passwords be ch... by Tomte on Sunday May 21, 2017 @01:49PM (#14388263)

Interoperability. Limiting resources (hardware implementation for AES on chip, as opposed to hardware implementations for n ciphers).

[ Parent | on HN ]