"YOLO" is not a valid hash construction

Re:"YOLO" is not a valid hash construction by tptacek on Saturday August 24, 2024 @07:43PM (#41342901)

I have a really hard time taking the attack research on password KDFs all that seriously. I don't think there are many common threat models where "weaknesses" in password hashes are more than marginal issues.

Not using a real password KDF is a big issue. Using the wrong one, not so much.

[ Parent | on HN ]

Re:"YOLO" is not a valid hash construction by FreakLegion on Saturday August 24, 2024 @09:21PM (#41343496)

I don't disagree at all. My comment is about paperwork and selling to the government ("operating in the FIPS world", as the post has it, where NIST enters the conversation). I'm sure you can get away with tacking PBKDF2 onto Argon2 here, but those are hoops you don't need to jump through.

[ Parent | on HN ]