Blake3 is 10 times faster than SHA-2

Re:Blake3 is 10 times faster than SHA-2 by nneonneo on Saturday January 11, 2020 @10:59PM (#22024371)

I don’t see how that follows. If HSrv is expensive or slow, a malicious client could just submit nonsense hashes that only look like they might have come from HCli - the server shouldn’t be able to tell the difference.

Requiring client-side JavaScript for your login system seems fraught. I would much rather have an approach that does server side hashing exclusively, but gates it behind some kind of DDoS protection or rate-limiting.

[ Parent | on HN ]

Re:Blake3 is 10 times faster than SHA-2 by pnako on Saturday January 11, 2020 @11:39PM (#22024514)

You do the slow (bcrypt, argon2 or whatever) hash in the browser, and then the server can do the hyper-fast hash (SHA256).

You can still flood the server, but you're flooding it with things that take microseconds to compute, instead of 50ms.

[ Parent | on HN ]

Re:Blake3 is 10 times faster than SHA-2 by tgb on Sunday January 12, 2020 @02:45PM (#22028704)

That's not what the article states, though it's not very explicit about why you shouldn't do what you suggest.

[ Parent | on HN ]