News for hackers. Stuff that matters.
Re:Your Username Will Now Serve as Your Password and Your Pa... by JoachimSchipper on Wednesday March 16, 2011 @04:25PM (#2333732)
This is an old comment, so I'll not type out a long reply, but note that bcrypt has random salts while your scheme has a fixed salt. With a large database of passwords plus your fixed salt, an attacker can try each calculated hash against each hashed password in your database. With sufficiently long random salts (bcrypt has 2^176 ~= 10^53 bits of salt, if I count correctly), the attacker only gets to try a calculated hash against one hashed password.

And yes, you should tune the number of rounds to get something sensible for your application.

There are no comments on this comment yet.