News for hackers. Stuff that matters.

A comment on Security Update. Parent comment

Re:Security Update by lucb1e on Friday May 17, 2019 @02:53AM (#19936958)
"X bcrypts per second" is completely meaningless. What was the bcrypt setting? With the right setting, it would not be more than 1 bcrypt per century, or with the wrong setting, an almost equivalent rate to md5. It depends.

More meaningful would be the speedup compared to a single CPU core, which is what the developers (should) benchmark against. They should make it as slow as possible, so if their system can do bcrypt with a cost of 15 in 0.1 seconds, they should set either that or cost 16. (Much more than 0.2s might be annoying to users or be a DOS vector.)

[ Parent | on HN ]
Re:Security Update by lazyjones on Friday May 17, 2019 @04:25AM (#19937444)
> With the right setting, it would not be more than 1 bcrypt per century

You can't really call that a "right" setting when it takes at least as long to log in...

[ Parent | on HN ]
Re:Security Update by lucb1e on Friday May 17, 2019 @06:17AM (#19938069)
Right was meant as necessary to achieve that effect (sorry, English is not my native language). Obviously this is not a recommendation but just to point out that its configuration ranges from negligible to (on today's computers) forever.
[ Parent | on HN ]
Re:Security Update by umanwizard on Friday May 17, 2019 @10:29AM (#19939920)
English is my native language, and I think the way you used "right" was fine. At any rate, I understood what you meant.
[ Parent | on HN ]