Monday, March 19, 2012

Don't use bcrypt

(Edit: Some numbers for you people who like numbers)

If you're already using bcrypt, relax, you're fine, probably. However, if you're looking for a key derivation function (or in bcrypt's case, password encryption function) for a new project, bcrypt is probably not the best one you can pick. In fact, there are two algorithms which are each better in a different way than bcrypt, and also widely available across many platforms.

I write this post because I've noticed a sort of "JUST USE BCRYPT" cargo cult (thanks Coda Hale!) This is absolutely the wrong attitude to have about cryptography. Even though people who know much more about cryptography than I do have done an amazing job packaging these ciphers into easy-to-use libraries, use of cryptography is not something you undertake lightly. Please know what you're doing when you're using it, or else it isn't going to help you.

The first cipher I'd suggest you consider besides bcrypt is PBKDF2. It's ubiquitous and time-tested with an academic pedigree from RSA Labs, you know, the guys who invented much of the cryptographic ecosystem we use today. Like bcrypt, PBKDF2 has an adjustable work factor. Unlike bcrypt, PBKDF2 has been the subject of intense research and still remains the best conservative choice.

There has been considerably less research into the soundness of bcrypt as a key derivation function as compared to PBKDF2, and simply for that reason alone bcrypt is much more of an unknown as to what future attacks may be discovered against it. bcrypt has a higher theoretical-safety-to-compute-time factor than PBKDF2, but that won't help you if an attack is discovered which mitigates bcrypt's computational complexity. Such attacks have been found in the past against ciphers like 3DES. Where 3DES uses a 168-bit key, various attacks have reduced that key size's effectiveness to 80-bits.

PBKDF2 is used by WPA, popular password safes like 1Password and LastPass, and full-disk encryption tools like TrueCrypt and FileVault. While I often poke fun at Lamer News as a Sinatra antipattern, I have to applaud antirez on his choice of PBKDF2 when he got bombarded with a "just use bcrypt!" attack (although bro, antirez, there's a PBKDF2 gem you can use, you don't have to vendor it)

The second cipher to consider is scrypt. Not only does scrypt give you more theoretical safety than bcrypt per unit compute time, but it also allows you to configure the amount of space in memory needed to compute the result. Where algorithms like PBKDF2 and bcrypt work in-place in memory, scrypt is a "memory-hard" algorithm, and thus makes a brute-force attacker pay penalties both in CPU and in memory. While scrypt's cryptographic soundness, like bcrypt's, is poorly researched, from a pure algorithmic perspective it's superior on all fronts.

The next time you need to pick a key derivation function, please, don't use bcrypt.

2,510 comments:

«Oldest   ‹Older   2401 – 2510 of 2510
furniture4u said...

I got so involved in this material that I couldn’t stop reading. I am impressed with your work and skill. Thank you so much. I would like to suggest you this for more information. Wardrobe Price in Pakistan
Recliner Price in Pakistan
Outdoor Furniture Price in Pakistan
Dining Table Price in Pakistan
Center Table Price in Pakistan
Bedroom Set Price in Pakistan

Yamas Furniture said...

Fantastic post, very informative. I wonder why the other specialists of this sector do not notice this. You must continue your writing. I am confident, you have a great readers’ base already!
Yamas Furniture
Office Furniture in Karachi
office chairs in Karachi
office table in Karachi
study table in Karachi
computer chair in Karachi
computer table in Karachi
Revolving Chair in Karachi

hafipestcontrolservics said...

Hello, I have browsed most of your posts. This post is probably where I got the most useful information for my research. Thanks for posting, maybe we can see more on this.
Fumigation Services Karachi
Termite Treatment Services in Karachi
Water Tank Cleaning Services in Karachi
Fumigation Services in Karachi

Jewel Studio said...

Pretty good post. I just stumbled upon your blog and wanted to say that I have really enjoyed reading your blog posts. Any way I’ll be subscribing to your feed and I hope you post again soon.
Jewel Studio
Silver Jewelry in Pakistan
Silver Bracelets Price in Pakistan
Silver Necklaces Price in Pakistan
Silver Earrings Price in Pakistan
Silver Chandi Ring Design for Girl
Silver Chandi Ring Design for Men

Karachi fire corpration said...

This Post is providing valuable and unique information, I know that you take the time and effort to make an awesome article.
fire fighting companies in pakistan
fire hydrant system
fire extinguisher price in pakistan
fire fighting equipment
dcp fire extinguisher

Karachi fire corpration said...

This is my first time i visit here. I found so many entertaining stuff in your blog, especially its discussion. From the tons of comments on your posts, I guess I am not the only one having all the enjoyment here! Keep up the excellent work.
fire alarm system in pakistan
afff fire extinguisher
fire fighting training
fire extinguisher price in karachi
fire safety equipment

Incrediblefitnesstips said...

I really enjoy simply reading all of your weblogs. Simply wanted to inform you that you have people like me who appreciate your work. Definitely a great post. Hats off to you! The information that you have provided is very helpful.
Incredible Fitness Tips
How to Improve Push-Ups
How many Calories does High Knees Burn
Top 10 Exercises for Parkinson’s Disease
14 Effective Exercises For Forearm

Incrediblefitnesstips said...

I enjoy your writing, and you clearly clarify each and every topic. Thank you for giving this useful knowledge.
Exercises for 6 Packs
Before and After Hip Dips
Major Hip Dips
Celebrities with hip dips
Back Fat Exercises

Professional Course said...

Happy to chat on your blog, I feel like I can't wait to read more reliable posts and think we all want to thank many blog posts to share with us.

Data Science in Bangalore

Matt Reeves said...

This post is so interactive and informative.keep update more information…
graphic design courses in velachery
graphic design courses in Chennai


mgowrimagalingam@gmail.com said...

master program in data science training
data science training in chennai
oracle primavera p6 training in chennai
artificial intelligence training in chennai

Gurugram Girls Pg said...

Your comment is very beautiful, it is very different, it is very good, there is nothing in this comment that does not look good, wish you could write such posts.
Yoga
Night Party Girls
Covid 19
Night Club
Goa Party

Training said...

I like viewing this web page which comprehend the price of delivering the excellent useful resource free of charge and truly adored reading your posting. Thank you!
Data Science Certification Course

Professional Course said...

First of all, you have a great blog. I will be interested in more similar topics. I see you have some very useful topics, I will always check your blog thank you.

Data Science Training Institutes in Bangalore

ركن كلين said...

تنظيف مكيفات
شركة تنظيف مكيفات بالرياض
شركة تنظيف مكيفات بشمال الرياض
شركة تنظيف مكيفات شرق الرياض
شركة تنظيف مكيفات غرب الرياض
شركة تنظيف مكيفات جنوب الرياض

Professional Course said...

I have read your article, it is very informative and useful to me, I admire the valuable information you offer in your articles. Thanks for posting it ...

Business Analytics Course in Ernakulam

web application development companies in chennai said...

Thanks for sharing this wonderful post. I was impressed your post. thanks for sharing.
Android development companies in chennai
Web Design Company in Chennai
website development company in chennai
website Re-design in chennai
Best Software company in Chennai
app development in chennai
Chennai SEO company
SEO Companies in Chennai
SEO Service in Chennai
mobile app development in chennai
Digital Marketing Company in chennai
Digital marketing Services in chennai
Online shopping Website Developers in chennai
SEO Company in Chennai

Dorado fashion said...

Dorado Fashion help to find the best necklaces, bracelets, earrings, and rings across the globe. There are many kinds of luxurious jewelry goods, but we also want to buy a few sets under different circumstances wearing ornate jewelry? Not necessarily have to spend too much money.

Cyberworx said...

This article is beneficial and exciting information. Thanks for sharing. Best SEO Services Delhi

Academyofappliedarts said...

This article is beneficial and exciting information. Thanks for sharing. If Are you looking for Interior Designing Courses and Diploma in Interior Designing.

klate said...

It's really great. Thank you for providing a quality article. Visit the link to hire our plumbing and drain Services:Emergency Plumbing Service

Training said...

Informative Post. The information you have posted is very useful and sites you have referred was good. Thanks for sharing.
Data Science Course with Placement

Technical Knowledge said...

I am always searching online for articles that can help me and you made some good points in Features also. Keep working, great job
Data Science Training

Training said...

Excellent post to make this blog more wonderful, attractive and cool stuff you have. Thank You.
Data Science Course in India with Placements

Dorado fashion said...

Dorado Fashion Review help to find the best necklaces, bracelets, earring, and rings across the globe. There are many kinds of luxurious jewelry goods, but we also want to buy a few sets under different circumstances wearing ornate jewelry? Not necessarily have to spend too much money.

Mani said...

Thank you for sharing this article. The information you've supplied is superior to that of another blog.

SEO in Chennai

Mani said...

Detective Agency in Chennai
Builders in Chennai
Construction in Chennai
Building Construction in Chennai
Construction in Chennai
Building Renovation in Chennai

Mani said...

Construction Companies in Chennai
Civil Contractors in Chennai
CCTV Camera Services in Chennai
Hit Trans
Advocates in Chennai
Divorce Case Lawyers in Chennai

Mani said...

De Addiction Centre in Chennai
Spark Equipments
Office Cleaning Serviuces in Chennai
MKS Furniture
Mars Sterile
De Addiction Centre in Chennai

Mani said...

Gal Windoors
Tiles Dealers in Chennai
Post Forming Shutters in Chennai
Turnkey Contractor in Chennai
Best Tattoo Shop in Chennai
PVC Blister Manufacturer in Chennai
Building Construction in Chennai
Best Building Contractors in Chennai

Mani said...

2d Plan Services in Chennai
CCTV Dealers in Chennai
Best Wedding Photographer in Chennai
JP Fire Safety Equipment
Green Home
Om Doors & Wood Works

allthing said...

http://www.unlimitednovelty.com/2012/03/dont-use-bcrypt.html

allthing said...

هل يجوز الصيام على جنابه

allthing said...

learn quran recitation

allthing said...

شركة تمديد الغاز المركزي بالرياض

Brian Joe said...

payroll software singapore
payroll system singapore

Unknown said...

payroll software
payroll system

Praveen Kumar said...

Really nice article. Thanks for sharing. Keep share much more.
hotels in yercaud near lake
yercaud hotels low price
hotel at yercaud tamil nadu

Professional Course said...

I am here for the first time. I found this table and found it really useful and it helped me a lot. I hope to present something again and help others as you have helped me.

Business Analytics Course in Nagpur

David said...

https://newminimilitia.com/

David said...

free of cost with a single click Download. hunting sky

David said...

download latest verion of spotify premium apk from here damon ps2 pro apk

Mattt Donavan said...


This post is so interactive and informative.keep update more information...
DevOps course in Tambaram
DevOps Training in Chennai

Praveen Kumar said...

Fantastic article. Thanks for sharing. Keep share much more.
hotels in yercaud near lake
yercaud hotels low price
hotel at yercaud tamil nadu

David Smith said...

Share market tips generated from NSE, BSE & MCX stock exchanges for trading in Indian stock market with highest accuracy Share market tips cover cash tips, derivative

Professional Course said...

Hello. I found your blog using msn. This is a very well written article. I'll be sure to bookmark it and come back for more useful information. Thanks for the post. I will definitely be back.

Data Science Training in Bangalore

Professional Course said...

This is an excellent article. I like this topic. This site has many advantages. I have found a lot of interesting things on this site. It helps me in so many ways. Thanks for posting this again.

Data Analytics Course in Durgapur

arasukumar said...

This is an informative and knowledgeable article. therefore, I would like to thank you for your effort in writing this article.
Data Scientist Course in Chandigarh

Scopex said...

Canli

Nathan said...

Very informative Blog! There is so much information here that can help thank you for sharing.
Data Analytics Course in Bangalore

Tech Institute said...

This is an informative and knowledgeable article. therefore, I would like to thank you for your effort in writing this article.
Data Science Course in Bangalore

خدمات تبوك said...

شركة تنظيف كنب بتبوك
شركة طارد حمام بتبوك
كهربائي بتبوك
معلم دهانات بتبوك
نجار بتبوك
شركة عزل خزانات بتبوك
شركة تنظيف منازل بتبوك
شركة تنظيف منازل بتيماء
شركة مكافحة حشرات بتيماء
تركيب طارد حمام بتيماء
دليل راحتك
شركة مكافحة حشرات بتبوك
شركة تنظيف منازل بتيماء
شركة صيانة الأجهزة المنزلية بتبوك
شركة تنظيف شقق بتبوك
شركة عزل خزانات في تبوك
شركة نقل عفش بتبوك
شركة تنظيف كنب بتبوك
نجار بتبوك
شركة تنظيف منازل بتبوك
خدمات نظافة بتبوك
دليل راحتي لخدمات المنازل
معلم بلاط بتبوك

kumal kumar said...

I read your excellent blog post. It's a great job. I enjoyed reading your post for the first time, thank you.
Data Science Institutes in Bangalore

aljani said...

#1 The Best Apps and Games For Android · Apk Module
https://apkmodule.com/jerkmate-mod-apk/
Jerkmate mod apk

Shaimaa Elsadek said...


شركه مكافحه صراصير الشارقه
شركه تنظيف في الفجيره
شركات تنظيف الكنب في عجمان
شركة تنظيف في دبي
شركات تنظيف المنازل في العين
شركة تنظيف فلل في دبي
شركة تنظيف فلل في الشارقة
شركات تنظيف وتعقيم
شركه تنظيف فلل العين
شركة تنظيف منازل بالعين

Aitechtonic said...

here you can learn, done and earn with your skills -- Blogging Tips - Fastread

KevinRhodes234 said...

Your website is very attractive and useful. Hey loved the post! Great post and reaching the top I will be back to visit often. Checkout FMWhatsApp APK

henrymiles said...

Very nice content is being provided which is very helpful to every one for their future needs and very reliable.
Learn Digital marketing from allied technologies and convert your business into an app development .
Affordable digital marketing agency is here which help in convert your business.

henrymiles said...

You ve really grown. This really shines! You make me want to learn more!

henrymiles said...

You discovered something new! I enjoyed reading this You are so ambitious

enligne-argent said...

gagner de l'argent sur internet

Professional Course said...

Very interesting blog. A lot of the blogs I see these days don't provide anything that interests me, but I'm really interested in this one. I just thought I would post and let you know.

Data Science Course in Ernakulam

jency said...

prisma 30ST rental
Prisma smart (Auto Cpap)
Prisma 25S (Auto bipap)

jency said...

Prisma 20S Rental
prisma 25st
Prisma 30ST (NIV)

Write for us digital marketing said...

Impressive article.Thankyou for providing this wonderful read.
Also visit my blog for Search Engine Insight

Professional Course said...

Gain expertise in the relevant and current practices, challenges, and research involved in the field of Data Science. Learn all the skills from non-coding essentials to data science and machine learning by enrolling in the Data Science course in Bangalore. Using real data sets across a range of domains enhances your skills in supervised and unsupervised learning, neural networks, sampling techniques, support vector machines, and more. Get certified in Data Science to get one step ahead towards a lucrative career.

Data Science Institute in Bangalore

عبير القحطان said...


شركه رواد الحرمين شركة رواد الحرمين الموقع الاول في تنظيف المكيفات بااحدث الطرق


شركه تنظيف مكيفات بالخبر

شركه تنظيف مكيفات بالقطيف

شركه تنظيف مكيفات بالجبيل

شركه تنظيف مكيفات بالاحساء

شركه تنظيف مكيفات بالدمام

Professional Course said...

Advance your technical skills required to crack huge datasets to bring out new possibilities from data. Join the Data Science institutes in Bangalore and get access to top industry trainers, LMS, live projects, assignments, and mock interviews to skyrocket your career in the ever- evolving field of Data Science.

Data Analytics Course in Bangalore

Professional Course said...

Acquire a firm grounding in the theory of Data Science by signing up for the Data Science courses in Bangalore. Master the relevant skills along with all the essential tools and techniques of Data Science. Get to avail benefits like Flexible timings, the best industry trainers, and a meticulously crafted curriculum with hands-on projects that will give you exposure to a real-world working environment.

Data Analytics Course in Bangalore

Professional Course said...

Data Analytics Course in Jaipur

Get dual certification from IBM and UTM Malaysia with the 360DigiTMG Data Science Certification program.

Data Analytics Course in Jaipur

Top 10 Free Business Listing Websites said...

Top 10 Free Web Hosting

Professional Course said...

Learn the fundamentals of Data Science and master the skills to handle epic amounts of data collected by organizations today. Gain expertise in organizing, analyzing, and transforming data to uncover its hidden power. Drive your career forward with a Data Science course in Bangalore and learn to uncover insights to present critical findings using visualization tools. Not only this, avail the best-in-class content delivered by stellar faculty who use a blended approach of theory as well as practical knowledge to ensure all the concepts are crystal clear.

Best Data Science Institute in Bangalore

David said...

Download the latest version of all types yummy.nu

Alice_12 said...

Share with everyone about distance, how far it is from a place to another place. So we can estimate or plan more detail your trip.

Professional Course said...

Register for the Data Scientist courses in Bangalore and learn to build your Data Science and Machine learning workflows. Build a portfolio of work to have on your resume with live projects which are supported by an industry-relevant curriculum. Get Access to our learning management system (LMS) that provides you with all the material and assignments that will help you master all the concepts for you to solve any problem related to deciphering the hidden meaning in data.

Data Science Training and Placement in Bangalore

RADHIKA said...

Meet Indian top quality Udaipur college girls best model available in our we gave high-class girls trust me and book your choice.

Professional Course said...


Are you looking for a Data Science course that will aid you in your career growth. 360DigiTMG is the right place for you. Enroll now for a better tomorrow.

Data Science Training in Calicut

Thomas Smith said...

Quality and trust are the foundations of Total Assignment Help's statistics homework help services. Please do not hesitate to contact us if you need assistance with an assignment.

FriskyWeb said...

FriskyWeb.com is one of the fastest growing platforms which are dedicated to provide a platform where passionate bloggers, content writers or whomsoever wants to write for the world can write.
FriskyWeb.com

Natures Pired said...

online sole proprietorship registration

Natures Pired said...

best sulphate free shampoo

BTree Systems said...

job support services
job support services

Professional Course said...

Learn to build powerful models to solve business problems by generating useful insights and discover the various scientific processes and methods used to transform the information available in huge datasets into meaningful results. master all the tools and techniques in Data Science and gain domain-specific knowledge which will help you to add more value to your profile. Sign up for the Data Science course in Bangalore with Placements and multiple your chances of working across all industries and job functions.

Data Science Institute in Bangalore

Professional Course said...

Get dual certification from IBM and UTM Malaysia with the 360DigiTMG Data Science Certification program.

Data Analytics Course in Jaipur

SENSA138 said...

Kemenangan sensasional ? Tentunya hanya bisa di dapatkan di situs slot online Terpercaya SENSA138 pasti sensasional.

salah ali said...

شركة تنظيف في دبي
شركة تنظيف في العين
شركة تنظيف في الشارقة
شركة تنظيف في عجمان
شركة تنظيف في ابوظبي
شركة تنظيف في راس الخيمة
شركة تنظيف في ام القيوين
شركة تنظيف في الفجيرة
شركة تنظيف في خورفكان
شركة تنظيف

SENSA138 said...

Permainan slot online yang menguntungkan memberikan Kemenangan di setiap putarannya hanya di sensa138 pasti sensasional

Stphen07 said...

Thanks for sharing like this content. I really appreciate sharing your post. and also you can go through this site and read the interesting thing we provide robotics projects in chennai

Natures Pired said...

The team at 36RPM have combined experience of 12 years in developing marketing strategies and developing E-commerce websites & plans.
seo company in Gurgaon

Travel_Life said...

Hi,

Thank You Very Much.

Blogger Hindi

Delhi Govt Jobs

Free Certification Course

yo-whatsapp said...

GB whatsapp New Version it has more new and innovative features that WhatsApp doesn’t have, some features include hide blue tick and last seen online status, it also provides your own various themes to make your choice more free and convenient .

FMWhatsappmod said...

Thanks for sharing such a great article, I am going to download fmwhatsapp apk this can be logged into two on the same device APK of an account to find my friends to share this high-quality article!

fouadwhatsapp.app said...

In our daily life, we are using social media applications. Without chat tools such as gb whatsapp download new version , our days are probably boring, and communication problems will be affected due to geographical distance

Top 10 Free Business Listing Websites said...

Thank you for the share. You are helping others to grow their knowledge by sharing such a valuable information very helpful

Thanks Again

SEOAUTH - SEO Submission Sites List

Haba Media said...

Harian Naggroe - Berita Politik Dunia

Presiden Ukraina
Pabrik Gandum di Gaza
Ekonomi Eropa
Zelensky ingin bertemu putin
Mata Uang Rusia
Peringatan AS ke Erdogan

Lee care.in said...

Thanks For Sharing Breaking News In Hindi
Thanks For Sharing Business News In Hindi

Beautyglaming said...

Thanks For Sharing ignou ms 100 project

SENSA138 said...

Rekomendasi Situs Permainan yang pasti di minati semua kalangan di indonesia tentunya hanya di situs slot online terpercaya

ABC said...

Thanks For Sharing Disposable Vape
Thanks For Sharing vaperdudes

SAHIL said...

Hi, Thanks for sharing your blog. Please review mine. digital marketing degree florida | Activate YouTube TV | Activate Twitch TV Thanks

developn design said...

thanks for share this information!we are providing the best SEO services in Chandigarh.Developndesigns is the world best SEO training institute. we are provider the all types of courses such as seo ,basic computer course, digital marketing, software skills as well as hardware skills apart from this designing, networking and more.
basic computer training in chandigarh
industrial training in Chandigarh

cleanservice24x7 said...

our company providing the the best cleaning service in Chandigarh.
Car Cleaning Services Provider in Chandigarh
Home Cleaning Services Provider in Chandigarh

White label NFT Marketplace said...

Hire ReactJS Developers from CronJ to leverage 9+ years of React handling and 15+ industrial experience at just $8 per hour!

hire reactjs developers
hire react developer

Professional Course said...

Are you looking for a Data Science training institute that will not only train you but also aid you in bagging a job, 360DigiTMG is the right place for you.

Data Science Training in Calicut

SENSA138 said...

Permainan slot online dengan kemenangan sensasional yang menanti di setiap putarannya dengan modal minim hanya di sensa138 terpercaya

Stphen07 said...

Thanks for sharing your precious time to create this post, it's so informative, and the content makes the post more interesting.really appreciated. we provide java project centers in chennai

Business News In Hindi said...

Thanks for sharing Sports News In Hindi

Professional Course said...

360DigiTMG offers the best Data Science certification course in the market with placement assistance. Get trained by IIT, IIM, and ISB alumni.

Data Analytics Course in Jaipur

arasukumar said...

Very informative Blog! There is so much information here that can help thank you for sharing.
Data Analytics Course in Bangalore

Vishyat Tech said...

Recovery One is an Athletic Recovery and Wellness Facility in Trim, Co.Meath in Ireland. We offer
https://www.recoveryone.ie/ best pilates reformer in Ireland>,
https://www.recoveryone.ie/compression-therapy
compression boots in Ireland , .
We offer the use of our elite equipment to enhance the recovery of our customers.The facilities at Recovery One offer
https://www.recoveryone.ie/ice-bath ice bath recovery in Ireland
which can also help non-athletes with their overall wellness and relaxation. Call us to order now or for pilates reformer classes near me.


«Oldest ‹Older   2401 – 2510 of 2510   Newer› Newest»