Timeline for Would this be considered a secure password hash?
Current License: CC BY-SA 4.0
24 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| S Feb 3, 2022 at 13:33 | history | suggested | U. Windl | CC BY-SA 4.0 |
Fix one spelling error, annd links to password managers, adding KeePass there, too
|
| Feb 3, 2022 at 12:41 | review | Suggested edits | |||
| S Feb 3, 2022 at 13:33 | |||||
| Feb 3, 2022 at 10:17 | vote | accept | Peter Morris | ||
| Feb 2, 2022 at 18:11 | history | edited | kelalaka | CC BY-SA 4.0 |
added entropy result of Squeamish Ossifrage
|
| Feb 2, 2022 at 13:41 | comment | added | polfosol | A nitpick: Lastpass is NOT free. It pretends to be so | |
| Feb 1, 2022 at 19:30 | comment | added | kelalaka | @PeterMorris default parameters? You can measure the time on your server. In general, we require that all processes must end in 1sec since we don't want to have a lag for the users. You can measure your server and ask about this on Information Security see this or search | |
| Feb 1, 2022 at 19:23 | comment | added | Peter Morris | @kelalaka Okay, I thought it would be okay to append. What kind of parameters am I going to need for memory size + iterations? I don't want my server crippled, but I don't want it too easy to break either. | |
| Feb 1, 2022 at 18:04 | comment | added | kelalaka | @PeterMorris And, your edition may well be fitted for Information Security, too. Look for answers, there too. | |
| Feb 1, 2022 at 18:03 | comment | added | kelalaka | @PeterMorris once answered, do not change the source especially after all of this.You can ask a new question instead. I've rollbacked it. | |
| Feb 1, 2022 at 18:01 | comment | added | Peter Morris | @kelalaka Thanks for your detailed reply. I've updated my question with regards to argon2. Would you mind letting me know what you think, please? Thanks! | |
| Feb 1, 2022 at 17:26 | history | edited | kelalaka | CC BY-SA 4.0 |
added 31 characters in body
|
| Feb 1, 2022 at 15:33 | comment | added | kelalaka | @N3buchadnezzar most of the time Bcrypt is fine, as stated in Wikipedia. However, Argon2 has parallelization factor, side-channel resistance, and independent parametrization ( see the parameter of the library and compare to BCrypt's) and Argon2 is also A KDF Bcrypt is not. | |
| Feb 1, 2022 at 14:31 | comment | added | N3buchadnezzar |
@kelalaka is there a reason why you suggest argon2 over something like en.wikipedia.org/wiki/Bcrypt?
|
|
| Jan 31, 2022 at 22:47 | comment | added | Cort Ammon | To put stefreak's comment in perspective, at current market prices you are talking about something on the order of four-tenths of a penny worth of DDR4 memory. If that is unacceptable, then I think it's worth thinking long and hard about whether you have the infrastructure needed for a system that involves money. | |
| Jan 31, 2022 at 19:43 | history | edited | kelalaka | CC BY-SA 4.0 |
added the release times.
|
| Jan 31, 2022 at 17:23 | history | edited | kelalaka | CC BY-SA 4.0 |
added some more information about Balloon hashing
|
| Jan 31, 2022 at 16:52 | history | edited | kelalaka | CC BY-SA 4.0 |
expand the Argon2
|
| Jan 31, 2022 at 11:17 | history | edited | kelalaka | CC BY-SA 4.0 |
answer to comment
|
| Jan 31, 2022 at 8:14 | comment | added | stefreak | @PeterMorris password hashing algorithms are used on servers almost 100% of the time. A quick google reveals that Argon2 uses 1MiB of memory by default. This is totally fine and usually not a problem. Please don't roll your own password hashing, this stuff is hard to get right. Especially if stakes are high. | |
| Jan 31, 2022 at 8:13 | comment | added | kelalaka | @PeterMorris Password hashing function has adjustable parameters. You need to set your security target then adjust the parameters. If you cannot use high memory then you need to increment the iteration count. You can find the performance on the hashcat forums especially for the GPUs. | |
| Jan 31, 2022 at 8:08 | comment | added | Peter Morris | I can't really use an algorithm that uses lots of memory (if I understood Memory Hardness correctly) because it's a server. Is the approach correct, is SHA512 suitable, and are the iterations suitable considering password length? | |
| Jan 31, 2022 at 0:12 | history | edited | kelalaka | CC BY-SA 4.0 |
added OpenSSL speed
|
| Jan 30, 2022 at 23:23 | history | edited | kelalaka | CC BY-SA 4.0 |
added 83 characters in body
|
| Jan 30, 2022 at 23:17 | history | answered | kelalaka | CC BY-SA 4.0 |