News for hackers. Stuff that matters.
Re:BitTorrent v2 (2020) by SAI_Peregrinus on Monday January 10, 2022 @03:54PM (#29882241)
To add to what others have already said:

A password hash is a function with 3 inputs: the password, the difficulty factor, and a customization structure (most often just a salt, sometimes more). A cryptographic hash is a function with 1 input: the message.

Password hashing functions have variable performance in time and usually memory and cache use, controlled by the difficulty factor. Cryptographic hashes have fixed performance.

Password hashing functions take a salt and possibly other customization data (a secret "pepper", a fixed domain-separation string if it's also a key derivation function, etc).

It's possible to build password hashes from cryptographic hashes. One must be very careful about encoding the multiple inputs into a single "message" for the cryptographic hash, to avoid cannonicalization attacks.

Argon2id is a good password hashing function.

There are no comments on this comment yet.