Monday, March 19, 2012

Don't use bcrypt

(Edit: Some numbers for you people who like numbers)

If you're already using bcrypt, relax, you're fine, probably. However, if you're looking for a key derivation function (or in bcrypt's case, password encryption function) for a new project, bcrypt is probably not the best one you can pick. In fact, there are two algorithms which are each better in a different way than bcrypt, and also widely available across many platforms.

I write this post because I've noticed a sort of "JUST USE BCRYPT" cargo cult (thanks Coda Hale!) This is absolutely the wrong attitude to have about cryptography. Even though people who know much more about cryptography than I do have done an amazing job packaging these ciphers into easy-to-use libraries, use of cryptography is not something you undertake lightly. Please know what you're doing when you're using it, or else it isn't going to help you.

The first cipher I'd suggest you consider besides bcrypt is PBKDF2. It's ubiquitous and time-tested with an academic pedigree from RSA Labs, you know, the guys who invented much of the cryptographic ecosystem we use today. Like bcrypt, PBKDF2 has an adjustable work factor. Unlike bcrypt, PBKDF2 has been the subject of intense research and still remains the best conservative choice.

There has been considerably less research into the soundness of bcrypt as a key derivation function as compared to PBKDF2, and simply for that reason alone bcrypt is much more of an unknown as to what future attacks may be discovered against it. bcrypt has a higher theoretical-safety-to-compute-time factor than PBKDF2, but that won't help you if an attack is discovered which mitigates bcrypt's computational complexity. Such attacks have been found in the past against ciphers like 3DES. Where 3DES uses a 168-bit key, various attacks have reduced that key size's effectiveness to 80-bits.

PBKDF2 is used by WPA, popular password safes like 1Password and LastPass, and full-disk encryption tools like TrueCrypt and FileVault. While I often poke fun at Lamer News as a Sinatra antipattern, I have to applaud antirez on his choice of PBKDF2 when he got bombarded with a "just use bcrypt!" attack (although bro, antirez, there's a PBKDF2 gem you can use, you don't have to vendor it)

The second cipher to consider is scrypt. Not only does scrypt give you more theoretical safety than bcrypt per unit compute time, but it also allows you to configure the amount of space in memory needed to compute the result. Where algorithms like PBKDF2 and bcrypt work in-place in memory, scrypt is a "memory-hard" algorithm, and thus makes a brute-force attacker pay penalties both in CPU and in memory. While scrypt's cryptographic soundness, like bcrypt's, is poorly researched, from a pure algorithmic perspective it's superior on all fronts.

The next time you need to pick a key derivation function, please, don't use bcrypt.

1,297 comments:

«Oldest   ‹Older   1201 – 1297 of 1297
Malik Furniture said...

I really appreciate your post, and you explain each and every point very well. Thanks for sharing such information.
Leather Sleeper Sofa Designs
Day Bed Sofa Designs
White Wardrobe New Designs
Bed Set Queen Designs
An affordable Wardrobe
New Designs of Dining Table
China Cabinet Hutch
Sofa and Loveseat Set

furniture4u said...

It's an amazing article. I admire this article for its well-researched content and excellent work. Furniture 4U
Gaming Chair Price in Pakistan
Office Chair Price in Pakistan
Computer Table Price in Pakistan
Sofa Set Price in Pakistan
Office Table Price in Pakistan

Jewel Studio said...

Pretty good post. I just stumbled upon your blog and wanted to say that I have really enjoyed reading your blog posts. Any way I’ll be subscribing to your feed and I hope you post again soon.
Jewel Studio
Silver Jewelry in Pakistan
Silver Bracelets Price in Pakistan
Silver Necklaces Price in Pakistan
Silver Earrings Price in Pakistan
Silver Chandi Ring Design for Girl
Silver Chandi Ring Design for Men

Incrediblefitnesstips said...

I really enjoy simply reading all of your weblogs. Simply wanted to inform you that you have people like me who appreciate your work. Definitely a great post. Hats off to you! The information that you have provided is very helpful.
Incredible Fitness Tips
How to Improve Push-Ups
How many Calories does High Knees Burn
Top 10 Exercises for Parkinson’s Disease
14 Effective Exercises For Forearm

Incrediblefitnesstips said...

I enjoy your writing, and you clearly clarify each and every topic. Thank you for giving this useful knowledge.
Exercises for 6 Packs
Before and After Hip Dips
Major Hip Dips
Celebrities with hip dips
Back Fat Exercises

Matt Reeves said...

This post is so interactive and informative.keep update more information…
graphic design courses in velachery
graphic design courses in Chennai


web application development companies in chennai said...

Thanks for sharing this wonderful post. I was impressed your post. thanks for sharing.
Android development companies in chennai
Web Design Company in Chennai
website development company in chennai
website Re-design in chennai
Best Software company in Chennai
app development in chennai
Chennai SEO company
SEO Companies in Chennai
SEO Service in Chennai
mobile app development in chennai
Digital Marketing Company in chennai
Digital marketing Services in chennai
Online shopping Website Developers in chennai
SEO Company in Chennai

Dorado fashion said...

Dorado Fashion help to find the best necklaces, bracelets, earrings, and rings across the globe. There are many kinds of luxurious jewelry goods, but we also want to buy a few sets under different circumstances wearing ornate jewelry? Not necessarily have to spend too much money.

Cyberworx said...

This article is beneficial and exciting information. Thanks for sharing. Best SEO Services Delhi

Academyofappliedarts said...

This article is beneficial and exciting information. Thanks for sharing. If Are you looking for Interior Designing Courses and Diploma in Interior Designing.

klate said...

It's really great. Thank you for providing a quality article. Visit the link to hire our plumbing and drain Services:Emergency Plumbing Service

Dorado fashion said...

Dorado Fashion Review help to find the best necklaces, bracelets, earring, and rings across the globe. There are many kinds of luxurious jewelry goods, but we also want to buy a few sets under different circumstances wearing ornate jewelry? Not necessarily have to spend too much money.

Mani said...

De Addiction Centre in Chennai
Spark Equipments
Office Cleaning Serviuces in Chennai
MKS Furniture
Mars Sterile
De Addiction Centre in Chennai

Mani said...

2d Plan Services in Chennai
CCTV Dealers in Chennai
Best Wedding Photographer in Chennai
JP Fire Safety Equipment
Green Home
Om Doors & Wood Works

allthing said...

http://www.unlimitednovelty.com/2012/03/dont-use-bcrypt.html

allthing said...

هل يجوز الصيام على جنابه

Dr. Poovathai Senthil Kumar - Salem said...

Really nice article. Thanks for sharing. Keep share much more.
hotels in yercaud near lake
yercaud hotels low price
hotel at yercaud tamil nadu

H.R said...

free of cost with a single click Download. hunting sky

H.R said...

download latest verion of spotify premium apk from here damon ps2 pro apk

Mattt Donavan said...


This post is so interactive and informative.keep update more information...
DevOps course in Tambaram
DevOps Training in Chennai

Dr. Poovathai Senthil Kumar - Salem said...

Fantastic article. Thanks for sharing. Keep share much more.
hotels in yercaud near lake
yercaud hotels low price
hotel at yercaud tamil nadu

Scopex said...

Canli

aljani said...

#1 The Best Apps and Games For Android · Apk Module
https://apkmodule.com/jerkmate-mod-apk/
Jerkmate mod apk

Shaimaa Elsadek said...


شركه مكافحه صراصير الشارقه
شركه تنظيف في الفجيره
شركات تنظيف الكنب في عجمان
شركة تنظيف في دبي
شركات تنظيف المنازل في العين
شركة تنظيف فلل في دبي
شركة تنظيف فلل في الشارقة
شركات تنظيف وتعقيم
شركه تنظيف فلل العين
شركة تنظيف منازل بالعين

Aitechtonic said...

here you can learn, done and earn with your skills -- Blogging Tips - Fastread

KevinRhodes234 said...

Your website is very attractive and useful. Hey loved the post! Great post and reaching the top I will be back to visit often. Checkout FMWhatsApp APK

henrymiles said...

Very nice content is being provided which is very helpful to every one for their future needs and very reliable.
Learn Digital marketing from allied technologies and convert your business into an app development .
Affordable digital marketing agency is here which help in convert your business.

henrymiles said...

You ve really grown. This really shines! You make me want to learn more!

henrymiles said...

You discovered something new! I enjoyed reading this You are so ambitious

Write for us digital marketing said...

Impressive article.Thankyou for providing this wonderful read.
Also visit my blog for Search Engine Insight

H.R said...

Download the latest version of all types yummy.nu

FriskyWeb said...

FriskyWeb.com is one of the fastest growing platforms which are dedicated to provide a platform where passionate bloggers, content writers or whomsoever wants to write for the world can write.
FriskyWeb.com

BTree Systems said...

job support services
job support services

Natures Pired said...

The team at 36RPM have combined experience of 12 years in developing marketing strategies and developing E-commerce websites & plans.
seo company in Gurgaon

Travel_Life said...

Hi,

Thank You Very Much.

Blogger Hindi

Delhi Govt Jobs

Free Certification Course

yo-whatsapp said...

GB whatsapp New Version it has more new and innovative features that WhatsApp doesn’t have, some features include hide blue tick and last seen online status, it also provides your own various themes to make your choice more free and convenient .

fouadwhatsapp.app said...

In our daily life, we are using social media applications. Without chat tools such as gb whatsapp download new version , our days are probably boring, and communication problems will be affected due to geographical distance

Top 10 Free Business Listing Websites said...

Thank you for the share. You are helping others to grow their knowledge by sharing such a valuable information very helpful

Thanks Again

SEOAUTH - SEO Submission Sites List

Haba Media said...

Harian Naggroe - Berita Politik Dunia

Presiden Ukraina
Pabrik Gandum di Gaza
Ekonomi Eropa
Zelensky ingin bertemu putin
Mata Uang Rusia
Peringatan AS ke Erdogan

developn design said...

thanks for share this information!we are providing the best SEO services in Chandigarh.Developndesigns is the world best SEO training institute. we are provider the all types of courses such as seo ,basic computer course, digital marketing, software skills as well as hardware skills apart from this designing, networking and more.
basic computer training in chandigarh
industrial training in Chandigarh

cleanservice24x7 said...

our company providing the the best cleaning service in Chandigarh.
Car Cleaning Services Provider in Chandigarh
Home Cleaning Services Provider in Chandigarh

Codevisionz - Learn to code said...

https://codevisionz.com

Rahul said...

You have written very good content, I am waiting for your other content to come, just upload it soon. Anyway, it provides courses to the students related to filmmaking, in which there are many courses like acting, direction, modelling and more. If you are interested in the filmmaking industry then you can watch it. Our script writing course is very famous and has a higher rating as the best Script writing course in Delhi & Mumbai, India.

123456789 said...

Vcare Technical Institute has been providing students with a rich and diverse learning environment. Our unparalleled teaching methods help to launch students into the successful future they have always dreamed of. Vcare Technical Institute is located in Laxmi Nagar, Delhi and has over 100 students and a renowned staff. We encourage both staff and students alike to grow, learn and create each passing day.

We are Provided Various Computer Courses Such as Computer Basic With Advanced, Core java, Advance java, Core PHP, Advance PHP++, Photoshop, Computer Typing and Other Courses. A Computer Course Overview Windows 7 overview, MS Word, MS Excel, MS Power Point, MS Publisher, MS Picture Manager, MS Outlook, MS Access, Basic HTML,
C++ training laxmi nagar Coding classes in Laxminagar , Internet- Search Engines, Email – Account creation, sending and receiving emails, Printing, Scanning, using external Media etc. Excel – creating spreadsheet, Applying formula, pivot table, H lookup, V lookup, filter, freeze, sorting, logical function.

drawingstudios said...

drawingstudios.com is a website that allows download the latest Mod APK Games & Apps, unlimited money, unlocked premium mod version easily overcoming the most ...

Masnet said...

Nice work here. Are you planning to send money from the USA to Nigeria? If so, I think you should check out the dollar to naira today black market rate in 2022/2023.
Check out the Uscd acceptance rate for 2022-2026.
Want to share airtime with your loved ones? see how to transfer airtime on Glo
Want to share airtime with your loved ones? see how to transfer airtime on MTN
See OAU Cut Off Mark
See all you need to know about POLAC Form





Vanessa Marano said...

Satta Matka Give You Dpboss Kalyan SattaMatka Number, Satta Market, Balaji Matka Result, Satta Matka 220 Patti, Morning Syndicate Night Satta .

Eye Care Hospital | Shree Eye Care said...

Shree Eye care is the Best Hospital in Dehradun

Sekarkelana said...

great...nice sharing with simple explanation for my blogJarumJahit.com

romantic talk said...

Meet Indian top quality udaipur girls or
udaipur cool girls best model available in our we gave high-class girls trust me and book your choice.
high profile house wife in udaipur

RADHIKA said...

Meet Indian top quality Udaipur college girls best model available in our we gave high-class girls trust me and book your choice.
Padosan bhabhi
girl friends meeting
udaipur model girls Mobile Number

dfgdfsg said...

The coupon can be used for three months until November 30th so that as many members can enjoy the benefits as possible 투데이서버

Country Cheap Ammo said...

Great article
countrycheapammo

asdasdas said...
This comment has been removed by the author.
Masro APK said...

watch live matches Stream india Apk
Pikashow tv apk

Masro APK said...

get latest apps and games free of cost apkmole

Divya said...

join top nursing coaching academy now. We have been giving training to hundreds of nursing students online and offline. We have top Indian faculty for giving Online and Offline coaching.
Chandigarh Staff Nurse Coaching
BSc MSc Nursing Tuition classes
pgi chandigarh 2022 recruitment
aiims norcet 2023 vacancy
esic staff nurse recruitment
hpssc staff nurse recruitment

Viswadhika said...

Looking forward to reading more. Great blog article. Great.

Vmware Online Training Institute from India, Hyderabad
Best Data Modelling Online Training
SAP Commerce Cloud Certification Online Training from Hyderabad
Oracle RAC Training Course Online
Best SCCM Online Certification Training India
SAP BW On Hana Online Training
Selenium with Python Online Live Classes

hanumanchalisa said...

Very informative blog
Hanuman Chalisa Lyrics pdf
Hanuman Chalisa Tamil pdf
Hanuman Chalisa English Pdf
Hanuman Chalisa Hindi Pdf
Hanuman Chalisa Bengali Pdf
Hanuman Chalisa Malayalam Pdf
Hanuman Chalisa Gujarati Pdf
Hanuman Chalisa Kannada Pdf

countrycheapammo said...

visit for handgun, rifle, shotgun and more.

Professional Course said...

Don't let pandemic affect your career growth, become a successful Data Scientist with the best course offered online at 360DigiTMG.

Data Science Course in Bangalore With Placement

web designing Training in bangalore said...

I was more than happy to uncover this great site. I need to to thank you for your time due to this fantastic read!! I definitely enjoyed every bit of it and I have you bookmarked to see new information on your blog.

https://infocampus.co.in/full-stack-development-training-in-marathahalli.html
https://infocampus.co.in/reactjs-training-in-marathahalli-bangalore.html
https://infocampus.co.in/ui-development-training-in-bangalore.html
https://infocampus.co.in/web-development-training-in-bangalore.html

sahana singh said...

I like your comment thanks for sharing.
fixing Water purifier in Nagpur

Anonymous said...

thanks for sharing valuable information, keep posting Java Classes In Pune

bhanusuru597 said...

The reason I usually recommend bCrypt is actually due to the human factors involved; essentially, bindings are available for every language, the API is consistent and fairly foolproof.

SHIVAM SHARMA said...


amazing writeup by author, keep doing.
python training in pune

Rajat sharma said...

Learn Advanced Excel in Laxmi Nagar
Learn Tally in Laxmi Nagar

SEO Pitara said...

Directory Submission | Bookmarking Sites | SEO Solution

jane robert said...

Great job on your blog! I thoroughly enjoyed reading it and gained a lot of valuable information. Please continue to share more blogs like this in the future. I look forward to reading more from you soon. Thank you for providing such valuable insights.
separation agreement in virginia

Brunda C said...

Thanks a lot for all your valuable articles! We are really happy about your thoughts...
Digital Marketing Training In Bangalore

valentina said...
This comment has been removed by the author.
valentina said...

Thank you for sharing informative blog.Abogado De Trafico En Virginia

Anonymous said...

Here you can download antiban GB whatsapp Apk from official link

Jasper said...

Amazing post i ever read.Abogado De Trafico En Virginia

jamesanderson said...

Thank you for this engaging and informative article! The meticulous research and impressive writing style have truly captivated me. Your work is commendable, and the wealth of information provided is fantastic. This insightful and wonderful post deserves my heartfelt appreciation. Thank you for enriching my knowledge
New Jersey Reckless Driving

Rupesh Kumar said...

Very useful tutorials and very easy to understand. Thanks for sharing. Ziyyara Edutech brings you the perfect solution with our comprehensive online English classes in Riyadh, Saudi Arabia.
For more info visit Spoken English classes in Riyadh or Call +971505593798

call girl neha khan said...
This comment has been removed by the author.
Rupesh Kumar said...

I really enjoyed this article. I need more information to learn so kindly update it. Ziyyara Edutech’s online tuition center offers personalized and comprehensive education, specifically designed to cater to the unique needs of Class 7 students.
Book A Free Demo Today visit Home tuition classes for class 7

Anvi Kapoor said...

https://bit.ly/3le8l6B

Best SEO Company in Chandigarh said...

Best SEO digital marketing In Punjab, Best SEO digital marketing in Gurgaon
Vishal Saini is one of the best SEO digital marketing experts and Best SEO digital marketing in Chandigarh. We have helped a lot of Best SEO digital marketing in Panchkula. businesses get better online exposure. Best SEO digital marketing in Amritsar. Vishyat Technologies offers SEO digital marketing Course in Zirakpur, Best SEO digital marketing in Mohali. Website development, SEO digital marketing, PPC, Backlink Building, Best SEO digital marketing in Zirakpur Content Development, Content Marketing, Conversion Rate Optimization, Email Marketing, Online Reputation Management, Best SEO digital marketing in Faridabad, Best SEO digital marketing in Noida, Brand Reputation Management, Hospital Reputation Management, Web Analytics and Internet Marketing.

MNK said...

Great sharing!

Regards,
BroadMind - One of the best Study abroad consultant in Madurai and the leading IELTS coaching in Madurai

MNK said...

Interesting post!

Regards,
BroadMind - Best IELTS coaching in Madurai and Study abroad consultant in Madurai

Rupesh Kumar said...
This comment has been removed by the author.
Rupesh Kumar said...

Nice blog! Thanks for sharing this valuable information. Discover the ultimate learning experience for your 7th standard student with Ziyyara Edutech's private online tuition classes.
Book A Free Demo Today visit Private tuition classes for class 7 student

Rupesh Kumar said...

Such a mind-blowing blog. I am very fascinated with the information. Welcome to Edtech Reader, your ultimate destination for discovering the best business listing sites. Our platform curates an extensive list of over 1000+ premium business listing sites to help you boost your online presence and grow your business.
visit Business Listing Sites

Rupesh Kumar said...

Nice post. Thank you to provide us this useful information. Explore the best AS level course options with Ziyyara Edutech's online AS level courses.
Book A Free Demo Today visit Online AS level course

grktraining said...

dcbncvd

hhh said...

[url=https://quranlight.net/]i quran light[/url]

Rupesh Kumar said...

This blog is really nice and informative blog, The explanation given is really comprehensive and informative. Welcome to Edtech Reader, your all-in-one resource for discovering free business listing sites tailored to the booming your Business visibility.
visit Business listing sites list

Rupesh Kumar said...

Thank you so much for sharing such amazing information, it’s really unique and valuable also. Ziyyara Edutech’s experienced tutors provide targeted support, helping you navigate through intricate subjects and conquer the complexities of the curriculum.
Book A Free Demo Today visit online tutoring sites for class 12

SEO Riddhi said...

Classified submission sites list are now an indispensable tool in this attempt because of their potent combination of targeted outreach and broad visibility.

StrongBox IT said...

Thanks for sharing this article. Its very useful article.

Cybersecurity Consulting Services | Penetration Testing Services in Chennai | Software Testing Services in Chennai | Application Security Testing Services | Infrastructure Security Testing Services

shane said...


"Unlimited novelty" typically refers to boundless creativity, originality, or the constant generation of new and innovative ideas without limitations. It can also signify an approach that encourages continuous exploration and experimentation in various fields. In a broader sense, the term embodies the concept of limitless novelty and fresh perspectives in creative endeavors or problem-solving.
uncontested divorce in virginia
virginia statute of limitations personal injury
northern virginia personal injury attorney
abogado de accidentes de semi camiones

Jake sully said...

Very Informative post.
paper airplane fighter

Ready said...

Thank You for Sharing This Great Post. Your Point of View Caught My Eye and It Was Very Interesting.

Mumbai Female Companion
Pune Female Companion
Solapur Female Companion

JPRII said...

thank you for sharing this information

full stack courses

slot138ss7 said...

wisma138situs game online mantap di jaman modern ini

«Oldest ‹Older   1201 – 1297 of 1297   Newer› Newest»