I want to make it as hard as possible to brute force data I hash. How can I make hashing take X seconds?
2
-
$\begingroup$ What is your actual problem here? Are you looking for password hashing? $\endgroup$– kelalakaDec 23, 2020 at 15:15
-
1$\begingroup$ Possible dupe of Very difficult hashing function?, or Slow hash algorithm that does not require salt? or Many consecutive hashes to slow down brute force attack? or are you looking for Is there a hash algorithm that is slow to calculate but relatively fast to check? $\endgroup$– kelalakaDec 23, 2020 at 15:22
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
0
Consider using key derivation functions like Argon2 or Lyra2. Unlike hash functions like SHA3 which are fast by design, key derivation functions are designed to consume much resources and make brute-forcing much harder.
Argon2 has for instance following parameters:
- The number of iterations
- Memory factor
- The number of threads or lanes
An attacker can use powerful CPUs or GPUs and run many brute-forcing processes in parallel. To limit such parallel computations you may increase the memory factor. Depending on the factor, this can mean higher costs for an attacker to buy/rent more memory.
On the other hand, keep in mind usability. If these data are requested often by users, may be they cannot wait to long, may be they will accept delays not more than 1-2 seconds.
answered Dec 23, 2020 at 14:10