Re:1Password and the Crypto Wars
by tedunangst on Saturday September 07, 2013 @02:10PM
(#6345902)
More accurately, they did call PBKDF2 once, but PBKDF2 internally calls itself twice if you request a key larger than the hash output size. It "expands" the key by generating two and concatenating. It's a stupid bug, but it's a bug in the spec.
[ Parent
| on HN ]
Just to be clear: it's fine to take the output of PBKDF2 and expand it with SHA2. They didn't do that, but that would have been a totally normal design with the same "problematic" performance characteristics.
Re:1Password and the Crypto Wars
by tedunangst on Saturday September 07, 2013 @05:23PM
(#6346676)
I'd just as soon pick sha2 as my pbkdf2 hash instead of bolting it on after the fact. That said, I'm not sure what's problematic. Expanding the key with sha2 results in the attacker needing to perform exactly as much work as you. There's no shortcut and no "problem".