Vesper 2.0 and Vesper Sync

Re:Vesper 2.0 and Vesper Sync by jhh on Wednesday May 28, 2014 @02:22AM (#7808649)

It's incorrect that salted hashes are obsolete or quickly attackable per se. Password hashes are a subset of all hashes. Therefore they are hashes. bcrypt uses an internal salt (as it says in the first two sentences of its Wikipedia page).

[ Parent | on HN ]

Re:Vesper 2.0 and Vesper Sync by ghshephard on Wednesday May 28, 2014 @04:22AM (#7808930)

Salted hashes have been irrelevant for at least 5 years, possibly more. It was a big deal in 1995-2004, back when "Rainbow Tables" were a thing. It just doesn't matter any more, and hasn't for a long time.

Don't be misled by the fact that bcrypt/pbkdf2/scrypt both use hashes, and have salts on the front - that's just a property of them, not their primary essence.

[ Parent | on HN ]

Re:Vesper 2.0 and Vesper Sync by tptacek on Wednesday May 28, 2014 @08:34AM (#7809562)

I think the right thing to say is that password hashes are all randomized, just like a salted hash --- but that when you say "salted hash", you are evoking SHAx(password, salt).

[ Parent | on HN ]

Re:Vesper 2.0 and Vesper Sync by jhh on Wednesday May 28, 2014 @10:27AM (#7810081)

So what is their primary essence?

[ Parent | on HN ]

Re:Vesper 2.0 and Vesper Sync by ghshephard on Saturday May 31, 2014 @07:46AM (#7825829)

Selectable time and memory difficulty of calculation.

[ Parent | on HN ]