News for hackers. Stuff that matters.

A comment on An HN style social news site written in Ruby/Sinatra/Redis/JQuery by Antirez. Parent comment

Re:An HN style social news site written in Ruby/Sinatra/Redi... by pjscott on Thursday October 20, 2011 @08:56PM (#3137825)
Try

SHA256(SHA256(... SHA256(password + salt)))

With perhaps five thousand iterations of SHA256, if you really don't want to depend on bcrypt. Or just use bcrypt; it's a good library, and removes the temptation to get creative with password hashing.

[ Parent | on HN ]
Re:An HN style social news site written in Ruby/Sinatra/Redi... by kingkilr on Thursday October 20, 2011 @10:16PM (#3138057)
Do not do this, repeated SHA'ing is not cryptographically secure: https://github.com/antirez/lamernews/pull/8#issuecomment-247...
[ Parent | on HN ]
Re:An HN style social news site written in Ruby/Sinatra/Redi... by pjscott on Friday October 21, 2011 @01:19AM (#3138547)
Oh really? If you use SHA1 then the scheme I just described is a pretty well-established method called PBKDF1, specified in RFC2898:

http://tools.ietf.org/html/rfc2898#section-5.1

[ Parent | on HN ]
Re:An HN style social news site written in Ruby/Sinatra/Redi... by lindvall on Friday October 21, 2011 @02:39PM (#3141069)
"PBKDF1 is recommended only for compatibility with existing applications since the keys it produces may not be large enough for some applications." — RFC 2898, September 2000
[ Parent | on HN ]
Re:An HN style social news site written in Ruby/Sinatra/Redi... by pjscott on Friday October 21, 2011 @03:38PM (#3141312)
The keys it produces are big enough for this application. PBKDF2 can produce output keys of arbitrary size, which is why PBKDF1 got deprecated, but it's not always necessary.
[ Parent | on HN ]