13 reputation
3
bio website
location
age
visits member for 1 year, 1 month
seen Sep 12 '13 at 18:08

Jul
21
awarded  Scholar
Jul
21
accepted Questions about BCrypt and PBKDF2
Jul
18
awarded  Student
Jul
17
comment Questions about BCrypt and PBKDF2
I'm just confused about using UPPERCASE username as SALT for PBKFD2... Could it be a weakness?
Jul
17
comment Questions about BCrypt and PBKDF2
Ok maybe 1000 logins per second is a bit exaggerated but 100 yes, it's possible! Considering that the server has also to decrypt RSA-2048 for SSL handshake, with Bcrypt (cost 10) + RSA it takes around 300ms on the server (tested) so it could potentially be a self-DoSsing! I thought this is the better thing: client-sidePBKDF2-SHA256 (64,000 iteractions with UPPERCASE username as salt). The result is sent to the server; the server hashes the result once (SHA256 or SHA512) with salt + pepper: ToStoreInDB = HMAC-SHA256($pbkdf2_result.$salt, $pepper). Please tell me if i'm in the right way!
Jul
17
comment Questions about BCrypt and PBKDF2
What's your motivation for slow-hashing on the client-side? I'm not going to use the client-side slow-hashing as a replace of SSL... All the communications will be over SSL anyway. I would do it simply because my system could receive even 1000 login requests per second in the moments of high-load, so with server-side slow-hashing, it could be a problem! It's not a web-server application but a Delphi Client/Server application. Does anyone know if there is a Scrypt implementation in Delphi?
Jul
16
awarded  Editor
Jul
16
revised Questions about BCrypt and PBKDF2
deleted 1 characters in body
Jul
16
asked Questions about BCrypt and PBKDF2