1
$\begingroup$

I usually choose bcrypt when hashing as I can set the work factor to slow down the calculations of the hash. However, I have to keep a copy of the hash in order to verify it (since it includes the salt) when the same input comes around again.

Are their any A) common and B) slow hashing algorithms that do not require a salt? In other words, I don't need to preserve the output state in order to calculate the exact same hash again?

I am not looking for a more secure/unbreakable hash - just one that takes a long, long time to work out.

At this point it seems that multiple rounds of SHA-256 is my current best option.

Improve this question
$\endgroup$
5
  • $\begingroup$ Is this for storing passwords, or something else? $\endgroup$
    – Stephen Touset
    Nov 7, 2012 at 19:52
  • $\begingroup$ It's for creating slow hashes of objects, using the output, and then discarding it rather than storing it. $\endgroup$
    – Xeoncross
    Nov 7, 2012 at 19:54
  • $\begingroup$ Is there any expectation that there will be objects smaller than 128 bytes? $\endgroup$
    – Stephen Touset
    Nov 7, 2012 at 20:45
  • $\begingroup$ @StephenTouset, yes. Could be as small as 12 bytes. $\endgroup$
    – Xeoncross
    Nov 7, 2012 at 23:20
  • $\begingroup$ Sorry, I meant to say bits (e.g., 16 bytes). 12 bytes should still be large enough that the objects' original contents can't be guessed via brute force if the site-wide salt is leaked, given that you're using a slow hashing function. $\endgroup$
    – Stephen Touset
    Nov 7, 2012 at 23:36

1 Answer 1

Reset to default
8
$\begingroup$

You can use any common slow hash construction that takes a salt with a constant salt. This includes scrypt, bcrypt and PBKDF2.

You obviously lose the benefit of the salt. Since the purpose of a salt is preventing multi-target attacks, now an attacker can attack all hashes at the same time. I'd use at least a salt that's unique for your application, so an attacker can't attack your application at the same time as others.

Personally I'd go with scrypt, since it strengthens the most for a given derivation time limit, but you can use bcrypt or PBKDF2 if you prefer older/more popular constructions.

Improve this answer
$\endgroup$
1
  • $\begingroup$ +1 duh, just use a constant salt. I'm not sure why I didn't think of that. $\endgroup$
    – Xeoncross
    Nov 7, 2012 at 19:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.