Reputation
806
Top tag
Next privilege 1,000 Rep.
See votes, expandable usercard
Badges
7 16
Newest
 Nice Answer
Impact
~15k people reached

  • 0 posts edited
  • 0 helpful flags
  • 9 votes cast
Jan
12
comment Why PHP password_hash does use blowfish intstead threefish?
7.1 would be the next minor version if PHP to be released. Reference - mailing list thread
Jan
12
comment Why PHP password_hash does use blowfish intstead threefish?
Agron2i will likely be the next successor to bcrypt, and is being worked on for 7.1
Jan
12
comment Why PHP password_hash does use blowfish intstead threefish?
The name that PHP uses inside of password_hash is bcrypt: php.net/password_hash so...
Oct
28
awarded  Nice Answer
Oct
28
awarded  Yearling
Apr
14
awarded  Popular Question
Dec
12
awarded  Critic
Sep
10
comment Recommended # of iterations when using PKBDF2-SHA256?
It does come out to 241ms. In fact, if you plug 8ms into the formula, you get approximately 23 hours out as "attacker patience". Which is a whole lot less than a month (for a single 32 bit entropy password)... And low enough where the recommended value of 8ms should likely be raised.
Aug
18
awarded  Enlightened
Aug
18
awarded  Nice Answer
Aug
18
awarded  Yearling
Aug
18
answered Has scrypt been broken, finally?
Jun
22
awarded  Notable Question
Feb
8
awarded  Scholar
Feb
8
accepted Timing Safe String Comparison - Avoiding Length Leak
Feb
5
comment Timing Safe String Comparison - Avoiding Length Leak
So, would something as an analog to the above (even with its potential length leak) be sufficient and beneficial in your opinion? Seems to be the general trend here.
Feb
5
awarded  Nice Question
Feb
3
comment Timing Safe String Comparison - Avoiding Length Leak
@mikeazo: I figured it was crypto simply due to it normally applying to practical implementations of crypto. If you could move it, it would be much appreciated! Thanks!
Feb
3
comment Timing Safe String Comparison - Avoiding Length Leak
For the record, this is related to an RFC for PHP to add a safe comparison function to core.
Feb
3
asked Timing Safe String Comparison - Avoiding Length Leak