News for hackers. Stuff that matters.

A comment on An HN style social news site written in Ruby/Sinatra/Redis/JQuery by Antirez. Parent comment

Re:An HN style social news site written in Ruby/Sinatra/Redi... by kingkilr on Thursday October 20, 2011 @10:16PM (#3138057)
Do not do this, repeated SHA'ing is not cryptographically secure: https://github.com/antirez/lamernews/pull/8#issuecomment-247...
[ Parent | on HN ]
Re:An HN style social news site written in Ruby/Sinatra/Redi... by pjscott on Friday October 21, 2011 @01:19AM (#3138547)
Oh really? If you use SHA1 then the scheme I just described is a pretty well-established method called PBKDF1, specified in RFC2898:

http://tools.ietf.org/html/rfc2898#section-5.1

[ Parent | on HN ]
Re:An HN style social news site written in Ruby/Sinatra/Redi... by lindvall on Friday October 21, 2011 @02:39PM (#3141069)
"PBKDF1 is recommended only for compatibility with existing applications since the keys it produces may not be large enough for some applications." — RFC 2898, September 2000
[ Parent | on HN ]
Re:An HN style social news site written in Ruby/Sinatra/Redi... by pjscott on Friday October 21, 2011 @03:38PM (#3141312)
The keys it produces are big enough for this application. PBKDF2 can produce output keys of arbitrary size, which is why PBKDF1 got deprecated, but it's not always necessary.
[ Parent | on HN ]