Re:1Password and the Crypto Wars
by tptacek on Saturday September 07, 2013 @04:46PM
(#6346558)
Just to be clear: it's fine to take the output of PBKDF2 and expand it with SHA2. They didn't do that, but that would have been a totally normal design with the same "problematic" performance characteristics.
[ Parent
| on HN ]
Re:1Password and the Crypto Wars
by tedunangst on Saturday September 07, 2013 @05:23PM
(#6346676)
I'd just as soon pick sha2 as my pbkdf2 hash instead of bolting it on after the fact. That said, I'm not sure what's problematic. Expanding the key with sha2 results in the attacker needing to perform exactly as much work as you. There's no shortcut and no "problem".