What We Do in the /etc./Shadow – Cryptography with Passwords

Re:What We Do in the /etc./Shadow – Cryptography with Passwords by FreakLegion on Saturday January 07, 2023 @05:45AM (#34286944)

The bit about selling to the government isn't quite right. Check out NIST SP 800-63B §5.1.1.2. They're very keen on memory-hard functions, as long as the underlying primitives are approved. For some reason they single out Balloon, which I wouldn't recommend since there's only a prototype implementation, but scrypt and yescrypt are usable.

[ Parent | on HN ]

Re:What We Do in the /etc./Shadow – Cryptography with Passwords by some_furry on Saturday January 07, 2023 @05:46AM (#34286949)

Thanks. I'm not a FIPS expert, and I try to avoid having to become a FIPS expert, so I appreciate these corrections.

(I've updated the post to encapsulate your correction.)

[ Parent | on HN ]