Monday, March 19, 2012

Don't use bcrypt

(Edit: Some numbers for you people who like numbers)

If you're already using bcrypt, relax, you're fine, probably. However, if you're looking for a key derivation function (or in bcrypt's case, password encryption function) for a new project, bcrypt is probably not the best one you can pick. In fact, there are two algorithms which are each better in a different way than bcrypt, and also widely available across many platforms.

I write this post because I've noticed a sort of "JUST USE BCRYPT" cargo cult (thanks Coda Hale!) This is absolutely the wrong attitude to have about cryptography. Even though people who know much more about cryptography than I do have done an amazing job packaging these ciphers into easy-to-use libraries, use of cryptography is not something you undertake lightly. Please know what you're doing when you're using it, or else it isn't going to help you.

The first cipher I'd suggest you consider besides bcrypt is PBKDF2. It's ubiquitous and time-tested with an academic pedigree from RSA Labs, you know, the guys who invented much of the cryptographic ecosystem we use today. Like bcrypt, PBKDF2 has an adjustable work factor. Unlike bcrypt, PBKDF2 has been the subject of intense research and still remains the best conservative choice.

There has been considerably less research into the soundness of bcrypt as a key derivation function as compared to PBKDF2, and simply for that reason alone bcrypt is much more of an unknown as to what future attacks may be discovered against it. bcrypt has a higher theoretical-safety-to-compute-time factor than PBKDF2, but that won't help you if an attack is discovered which mitigates bcrypt's computational complexity. Such attacks have been found in the past against ciphers like 3DES. Where 3DES uses a 168-bit key, various attacks have reduced that key size's effectiveness to 80-bits.

PBKDF2 is used by WPA, popular password safes like 1Password and LastPass, and full-disk encryption tools like TrueCrypt and FileVault. While I often poke fun at Lamer News as a Sinatra antipattern, I have to applaud antirez on his choice of PBKDF2 when he got bombarded with a "just use bcrypt!" attack (although bro, antirez, there's a PBKDF2 gem you can use, you don't have to vendor it)

The second cipher to consider is scrypt. Not only does scrypt give you more theoretical safety than bcrypt per unit compute time, but it also allows you to configure the amount of space in memory needed to compute the result. Where algorithms like PBKDF2 and bcrypt work in-place in memory, scrypt is a "memory-hard" algorithm, and thus makes a brute-force attacker pay penalties both in CPU and in memory. While scrypt's cryptographic soundness, like bcrypt's, is poorly researched, from a pure algorithmic perspective it's superior on all fronts.

The next time you need to pick a key derivation function, please, don't use bcrypt.

2,280 comments:

«Oldest   ‹Older   2201 – 2280 of 2280
Digital Marketing Course said...

I was browsing the internet for information and found your blog. I am impressed with the information you have on this blog.
Digital Marketing Course in Bangalore

Teri billo said...

I'm Professional call girl in Chandigarh.
Chandigarh escort service
Chandigarh escorts
Chandigarh Call girls service
Escort service in Chandigarh
Chandigarh escorts

Business Analytics Course said...

From this post I know that your good knowledge of the game with all the pieces has been very helpful. I inform you that this is the first place where I find problems that I look for. You have a clever but attractive way of writing.
Business Analytics Course

Sargun Mehta said...

Amongst all the ladies out here with us, these salacious associates are said to work out well in reviving your moods thus minimizing all sorts of depressions and anxieties with Escorts in Raipur.

Follow Us:-
Escorts in Raipur
Raipur Escorts
Raipur call girls

allthing said...

عملية تكميم المعدة في تركيا

Data Analytics Course said...

I finally found a great article here. I will stay here again. I just added your blog to my bookmarking sites. Thank you. Quality postings are essential to get visitors to visit the website, that's what this website offers.
Data Analytics Course in Bangalore

Hyderabad mid night said...

Welcome to Hyderabadmidnight.com escorts agency, and hire guys! Over 1000+ call girls Hyderabad - You find here the best female Hyderabad escorts service in .
Hyderabad escorts
Company
Models
Service
Pocket
Get Touch
Blog

Kashi Digital Agency said...

Appreciate to peruse marvelous substance from this site. I bookmarked this site.


Digital Marketing Company In India
SEO Company In Varanasi | SEO Services In Varanasi
Website Design Company In Varanasi
Cheap Website Design Company In Bangalore
Website Designer, maker, creator, developer Near me
Best Software Company In India
Varanasi CAB | Taxi, Cab Service In Varanasi | Airport Cab | Car Rentals in Varanasi
Ratanmatka | Satta Matka | Kalyan Matka | Matka Result | Matka
Health And Beauty Products Manufacturer

Kashi Digital Agency said...

Seo services in Varanasi : Best SEO Companies in Varanasi: Hire Digital Marketing Agency, best SEO Agency in Varanasi who Can Boost Your SEO Ranking, guaranteed SEO Services; SEO Company In Varanasi.

Digital Marketing Company In India : Kashi Digital Agency is one of the Best Digital Marketing companies in Varanasi, India . Ranked among the Top digital marketing agencies in India. SEO Company In India.

Cheap Website Design Company In Bangalore : Best Website Design Company in Bangalore : Kashi Digital Agency is one of the Best Social Media Marketing agency in Bangalore which provides you the right services.

E-commerce Website design company India : e-commerce Company in India : Kashi Digital Agency is one of the best e-commerce development services provider in Varanasi, India. This one of the best service if you want quick ROI.

dzonesami said...

such a nice article. the information that you have provided is very useful.

Digital Marketing course in dzone gives you an in-depth understanding and advanced knowledge of all important fundamentals of digital marketing, also includes experience in real-world projects and domain experience. dzone will provide you with all necessary study material. To know more visit our website:http://bit.ly/digitaldzone
Or you can contact us at:9829708506

Rimpi said...


Chandigarh Escorts, book online college girls, models, House Wife and more.
Follow us:-

https://www.priyankabajaj.in
http://www.ritukaur.in/
http://nightgirl.in/
http://www.chandigarhescorts.net

7starsimranesc said...

Make an erotic fun with sexy Jaipur escorts right now. Find the most beautiful Jaipur call girls on 7starsimranescorts.com. Jaipur Escort agency provide incall & outcall Jaipur escort service.
jodhpur escorts
udaipur escorts

Data Science Training in BLR said...

I wanted to leave a little comment to support you and wish you the best of luck. We wish you the best of luck in all of your blogging endeavors.

Data Science Training in Bangalore

Digital Marketing Training in BLR said...

Really impressed! Everything is a very open and very clear clarification of the issues. It contains true facts. Your website is very valuable. Thanks for sharing.

Digital Marketing Training in Bangalore

k2best herbal incense said...

Buy Xanax bars online

Buy Oxycodone online

Buy Adderall online

Buy Crystal meth online

Sleeping pills for sale

Buy Pain Tablets wholesale

Global Cocaine Shop

Buy Legal High

Buy Herbal Incense

Buy Cystal Meth

Artificial Intelligence Training in BLR said...

I am a new user of this site, so here I saw several articles and posts published on this site, I am more interested in some of them, hope you will provide more information on these topics in your next articles.

Artificial Intelligence Training in Bangalore

Machine Learning Course in BLR said...

Happy to chat on your blog, I feel like I can't wait to read more reliable posts and think we all want to thank many blog posts to share with us.

Machine Learning Course in Bangalore

ROHI said...

Thank you so much, nice to see such a post to write such a beautiful post, and when I saw this post of yours, I was very happy to see its design and when I read it, I love to appreciate it. Because those who write such a beautiful post must get credit for it
ESCORTS IN GOLF COURSE ROAD
ESCORTS IN MANESAR
ESCORTS IN IMT MANESAR
ESCORTS IN NOIDA SECTOR 13
ESCORTS IN NOIDA
CALL GIRLS IN NOIDA CITY CENTRE
CALL GIRLS IN GURGAON
ESCORTS IN DELHI AIRPORT AREA
ESCORTS IN DELHI
CALL GIRLS PHOTOS

sweetiepatel said...

call girls in Ambala In any of the particular locations you wish to be linked to the well developed babes here with us, they are mostly adjustable to any environment.

Ambala Escorts
Ambala Escorts Service
Ambala Escorts Service

sweetiepatel said...

call girls in Ambala In any of the particular locations you wish to be linked to the well developed babes here with us, they are mostly adjustable to any environment.
Ambala Escorts
Ambala Escorts Service

Devina said...

Pick Hyderabad escorts + Hotel Charges 2500 include + Contact/Whatsapp 4 Hyderabad escort service.

kelly sharma said...

Pune Escort Service The ladies over here desperately desire to fill in the hearts and souls of customers who all are in requirements.
Pune Escorts
call Girls in Pune
Pune Escort Service

Night Call Girl said...


Chandigarh Escorts, book online college girls, models, House Wife and more.
Follow us:-

https://www.priyankabajaj.in
http://www.ritukaur.in/
http://nightgirl.in/

Bad Pari said...

Amritsar Escort service have all sorts of skills in meeting the desires of men whenever they require. It is fine characteristics of these ravishing hot babes which is going to call out clients from all parts of this world.
Follow us:-

Amritsar Escort
Amritsar Escorts Service
Amritsar Escorts
Amritsar Call Girls
Amritsar Escorts Service
Call Girls in Amritsar

Bad Pari said...

The busty hot Call Girls in Amritsar have all kinds of skills in meeting all sorts of desires and demands of their customers making each one of them feel highly pleased.
Follow us:-

Amritsar Escorts Service
Escorts Service in Amritsar
Amritsar Escorts Service
Amritsar Call Girls
Amritsar Escorts Service
Call Girls In Amritsar

Data Science Training in BLR said...

A good blog always contains new and exciting information and as I read it I felt that this blog really has all of these qualities that make a blog.

Data Science Training in Bangalore

Artificial Intelligence Training in BLR said...

You have completed certain reliable points there. I did some research on the subject and found that almost everyone will agree with your blog.

Artificial Intelligence Training in Bangalore

Tamil novels said...

Thank you for sharing this valuable information with us.
Tamil novels pdf download
Ramanichandran novels PDF
srikala novels PDF
Mallika manivannan novels PDF
muthulakshmi raghavan novels PDF
Infaa Alocious Novels PDF
N Seethalakshmi Novels PDF
Sashi Murali Tamil Novels PDF

vikram said...

amazing post thanks for the sharing beautiful post
everyone looking software agency
brisk logic is a software design app development and web design agency is located in Mohali India
software development agency

Rimpi said...


Chandigarh Escorts, book online college girls, models, House Wife and more.
Follow us:-

Zirakpur escort
Mohali escorts service
Kharar call girls
Call Girls Panchkula
Chandigarh Escorts
Chandigarh Escorts Service
Call Girls in Chandigarh
Chandigarh Escorts in Service

Dubai Fun Club said...

Connect Dubai Fun Club for premium Dubai Escorts and entertainment services. You can easily find the best call girls in Dubai on our website.

Zeba Khan said...

Goa Escorts and Independent Goa call girls here 24hours at goatimespendescorts.com escort agency. We have provide high profile Goa escort service.

Valluva said...

Thank you for sharing

vanhelsing said...

Wonderful blog.Thanks for sharing such a useful information..
PHP Training in Chennai
PHP Certification Online
PHP Training in Bangalore


Valluva said...

Thanks For Your Blog
cloud hr software
best payroll software singapore

Valluva said...

Thanks For Your Blog
claims management system
leave management system

Jordi said...

Clash of Clans Mod APK
Lucky Patcher Mod APK
Netflix Mod APK
Pubg Mobile Mod APK
Tekken 3 APK Download

Digital Marketing Training in BLR said...

It is late to find this act. At least one should be familiar with the fact that such events exist. I agree with your blog and will come back to inspect it further in the future, so keep your performance going.

Digital Marketing Training in Bangalore

Artificial Intelligence Training in BLR said...

A good blog always contains new and exciting information, and reading it I feel like this blog really has all of these qualities that make it a blog.

Artificial Intelligence Training in Bangalore

Machine Learning Course in BLR said...

I am more curious to take an interest in some of them. I hope you will provide more information on these topics in your next articles.

Machine Learning Course in Bangalore

Kashi Digital Agency said...

Thank you for the amazing content.


Seo services in Varanasi : Best SEO Companies in Varanasi: Hire Digital Marketing Agency, best SEO Agency in Varanasi who Can Boost Your SEO Ranking, guaranteed SEO Services; SEO Company In Varanasi.

Digital Marketing Company In India : Kashi Digital Agency is one of the Best Digital Marketing companies in Varanasi, India . Ranked among the Top digital marketing agencies in India. SEO Company In India.

 Cheap Website Design Company In Bangalore : Best Website Design Company in Bangalore : Kashi Digital Agency is one of the Best Social Media Marketing agency in Bangalore which provides you the right services.

E-commerce Website design company India : e-commerce Company in India : Kashi Digital Agency is one of the best e-commerce development services provider in Varanasi, India. This one of the best service if you want quick ROI.

Kashi Digital Agency said...

This is a great inspiring article.I am pretty pleased with your good work

Digital Marketing Company In India
SEO Company In Varanasi | SEO Services In Varanasi
Website Design Company In Varanasi
Cheap Website Design Company In Bangalore
Website Designer, maker, creator, developer Near me
Best Software Company In India
Varanasi CAB | Taxi, Cab Service In Varanasi | Airport Cab | Car Rentals in Varanasi
Health And Beauty Products Manufacturer
Affordable responsive website design services delhi

KITS Technologies said...

nice post.
SAP Grc training
SAP Grc online training

Valluva said...

payroll software
organic chemistry tutor

KAAM24 said...


post free job
job in noida

james said...

Thanks for the detailed article on this topic. I would like to see more such awesome articles from you.Download GBWhatsApp APK

KITS Technologies said...

nice post.
P0wer bi onlinetraining from india
P0wer bi onlinetraining

Data Analytics Bangalore said...

I feel very grateful that I read this. It is very helpful and very informative and I really learned a lot from it.
Data Analytics Course

Data Science Courses said...

I am really enjoying reading your well written articles. I am looking forward to reading new articles. Keep up the good work.
Data Science Courses in Bangalore

samuelmorkel said...

really like this Blog! nice point of view.
Protractor Online Training

Get It SMS said...

My brother recommended, I might like this web site. He was totally right. This put up actually made my day. You can not believe just how much time I had spent for this information! Thank you for sharing I believe a lot of people will be surprised to read this article. This article provides light by which we can notice the reality. This really is very nice one and allows advanced information. Get It SMS is a India No 1 bulk SMS Service provider. We are giving special offer in bulk SMS service. Our Services are Voice SMS, promotional bulk SMS, transactional SMS, miss call service, bulk e-mailing, transactional bulk SMS, Missed call alert Whatsapp SMS and website Design. Sign Up for a free trial!
Whatsapp Bulk SMS Service Provider Bangalore
Bulk SMS Service Provider in Bangalore
Bulk SMS Service Provider in Bangalore
Email Marketing Services in Bangalore, Gurugram, Jaipur, India

Valluva said...

payroll software
Chemistry Online Tutor
Thank you for sharing

AI Courses said...

What an incredible message this is. Truly one of the best posts I have ever seen in my life. Wow, keep it up.
AI Courses in Bangalore

Tutorials said...

Valuable Information. Its very useful for me. Thank You
   AWS training in chennai     AWS course in Chennai 

Business Analytics said...

I am sure it will help many people. Keep up the good work. It's very compelling and I enjoyed browsing the entire blog.
Business Analytics Course in Bangalore

John Haris said...

Excellent Post. Thanks for writing. You may also visit this site

jasonbob said...

supreme
lebron 17 shoes
giannis antetokounmpo shoes
jordan shoes
bape
yeezy
kyrie shoes
kyrie 4
steph curry shoes
kobe

Tutorials said...

Valuable Information. It's very useful for me. Thank You

AWS training in chennai | AWS course in Chennai

Unknown said...

Manali is the best destination for your Manali Tour. Vacation Triangle, a leading travel agency in Himachal Pradesh. We have an amazing package for the Kullu Manali tour. The best Packages available on our site are Manali Tour Planning, Manali Tour, Manali Weekend Tour, Manali Honeymoon Tours and much more. For best packages and services in Kullu Manali visit our website: https://vacationtriangle.com/packages/?location=himachal%20pradesh

Jessie said...

Useful article! Thanks for Sharing..

delete hulu account
delete instagram
delete saved password
delete reddit
delete spotify account

Benjamin said...

Call 913-815-8427 if you need tree removal in Olathe, KS.

https://www.olathetreeremoval.com

Brisk Logic said...

web development agency

seo training institute said...

Whatsapp Number Call us Now! 01537587949
outsourcing
iphone repair USA
careful
Company Registration Bangladesh
Freezing Ambulance Service

Sahil Sachdeva said...

Thanks for allowing us to add comments here. Get the best development solutions from India's best Web Development Company. Check the deals here;

hire php developers | hire laravel developers | hire codeigniter developers | hire reactjs developers | hire java developers

Thanks

Unknown said...


Saint Momina School is the best cbse school in bulandshahr. we are committed to spreading understanding and bringing people together.

Best cbse school in bulandshahr
best private school in bulandshahr

bruce wayne said...

Great blog.thanks for sharing such a useful information
BDD with Cucumber Online Training

bruce wayne said...

Great blog.thanks for sharing such a useful information
Pytest Online Training

Valluva said...

Belt grinder manufacturers
Polishing machine manufacturers

top10india said...


Top-10.in is a comparison platform that brings you useful top 10 lists covering
a wide variety of products and services that can help you save time and money.


Top10india
Top10review

Valluva said...

Thanks For Your Blog
Inexpensive Online Chemistry Tutor
Grade in Chemistry

Sonia Khan said...

Thanks for contact me 在拉合尔伴游

daisoftware said...

That's indeed a very detailed list of blog commenting websites.
online meal kit delivery services

thomas said...

Thanks for sharing this valuable piece of information. Keep sharing more such awesome articles in the future. Goodbye! Download FMWhatsApp APK

block side said...

I have benefited a lot from watching your advertisement and I have learned a lot from now on. Thank you Visit the website https://sattamatkaofficial.net/ India satta matka website; find satta matka fastest result of इंडियन मटका 155, kalyan matka, sattamataka.in net, satta matka Jodi chart, sattamataka143, sattamàtka, golden matka, sattaking143 guessing, satkamatka.com, Sattaking, and more. Our advanced tips & tricks helps to play this satta game properly. The tips provided by our expert matka guessers that help you to win the game and become the satta king.

Tutorials said...

Nice article with valuable information. Thanks for sharing.

Python training in chennai | Python course in Chennai

Luxury Perfumes said...

this is the one i am searching in google to read, if you wish to buy perfumes dubai check our website. we are the best perfumes seller and manufacturer in UAE.

allthing said...

شركات نقل الاثاث بالمهندسين

Brisk Logic said...

very nice article , thank you for the post everyone is looking for this type article brisk logic best web development agency best web development agency

Tutorials said...

Nice article with valuable information. Thanks for sharing.

Python training in chennai with placement | Python certification course in Chennai

John Haris said...

Very useful content. Also visit this site

«Oldest ‹Older   2201 – 2280 of 2280   Newer› Newest»