BCrypt is an adaptive cryptographic hash function for passwords. It incorporate a salt to protect against rainbow table attacks and is also an adaptive hash - over time it can be made slower and slower so it remains resistant to specific brute-force search attacks against the hash and the salt.
Our developer, let's call him 'Dave', insists on using a home-brew script for hashing passwords. See Dave's proposal below. We have already researched and adopted an industry standard protocol using ...
This question made me start thinking about password hashing again. I currently use bcrypt (specifically py-bcrypt). I've heard a lot about PBKDF2, and scrypt. What I'm wondering is if there are any ...
I've read various opinions about whether Bcrypt or PDBKF2 is a better key derivation hashing method. The answer seems to depend on a lot of complicated factors that are not easy to analyze. Would ...
For hashing passwords in a database, i would like to add a pepper to the hash function. Of course this pepper will be additionally to the unique salt. The reason why i want to add a pepper is, that ...
We have a website where users need to log in to access privileged information. Obviously we are using SSL, but I also want to avoid plaintext passwords from accidently ending up in server logs, or ...
I just wanted to know if you can increase the cost (iterations) of those two algorithms off-line. I want to increase the cost every year of my users passwords. One solution is to recalculate them ...
Edit: Updated to put more emphasis on the goal - peace of mind for the user, and not beefing up the security. After reading through a few discussions here about client side hashing of passwords, I'm ...
We hesitated between BCrypt and PBKDF2 for password hashing. In many forums and blogs people say something like "In their Special Publication SP 800-132 NIST basically recommends using PBKDF2 for ...
I'm looking to encrypt files using secure hashing and encryption algorithms in Python. Having used bcrypt in the past, I decided to use it for my passphrase calculator, then pass the output through ...