Typing the Letters A-E-S Into Your Code (2009)

Re:Typing the Letters A-E-S Into Your Code (2009) by laex on Saturday January 10, 2015 @12:48AM (#8866064)

There's a portion that says that using SHA-1 for generating a key is bad. Can anyone explain why ?

[ Parent | on HN ]

Re:Typing the Letters A-E-S Into Your Code (2009) by StavrosK on Saturday January 10, 2015 @02:59AM (#8866276)

Because hash functions are really fast, so using them to derive keys from low-entropy sources is really bad: Someone could just iterate over the low-entropy source and get the SHA-1 of each one in virtually zero time.

Brute force is really fast, and hash functions don't help you make it slower at all.

[ Parent | on HN ]

Re:Typing the Letters A-E-S Into Your Code (2009) by tedunangst on Saturday January 10, 2015 @12:59AM (#8866097)

http://codahale.com/how-to-safely-store-a-password/

[ Parent | on HN ]

Re:Typing the Letters A-E-S Into Your Code (2009) by jerematasno on Tuesday January 13, 2015 @08:34PM (#8883737)

That link is not wrong, but scrypt is probably significantly better than bcrypt, and PBKDF2 is not terrible, if you don't have a handy bcrypt/scrypt library.

[ Parent | on HN ]