Blake3 is 10 times faster than SHA-2

Re:Blake3 is 10 times faster than SHA-2 by stevefan1999 on Saturday January 11, 2020 @09:10PM (#22023965)

And we should all use bcrpyt to hash password. We all should have had it long long time ago, and people are still rolling out their own password hashing with salting mechanism. Biggest facepalm in the industry in my eyes.

[ Parent | on HN ]

Re:Blake3 is 10 times faster than SHA-2 by blattimwind on Saturday January 11, 2020 @09:12PM (#22023973)

not processing plaintext passwords on your server >> argon > scrypt > bcrypt > pbkdf2 >>> any hash

[ Parent | on HN ]

Re:Blake3 is 10 times faster than SHA-2 by CaptainMarvel on Sunday January 12, 2020 @05:30AM (#22025571)

There is an algorithm to authenticate without sharing the plaintext password from client to server, nor server to client - SRP. I know Apple uses it.

[ Parent | on HN ]

Re:Blake3 is 10 times faster than SHA-2 by ris on Sunday January 12, 2020 @06:07AM (#22025689)

Unless any of your users ever try and use a >72 character password.

[ Parent | on HN ]

Re:Blake3 is 10 times faster than SHA-2 by masklinn on Sunday January 12, 2020 @06:46AM (#22025834)

TBF that's super easy to work around: just prehash the key.

In fact, an other risk of bcrypt is that any nul byte will truncate the key, so you probably want to hash the password with something else (SHA384 or SHA512/256 for instance) then base64/base85-encode it before passing it to bcrypt.

[ Parent | on HN ]