91 reputation
3
bio website sweetsoftware.com
location
age
visits member for 2 years, 2 months
seen 15 hours ago

Software Developer (since childhood) and Electrical Engineer (don't you love the micro-hardware movements - Arduino and rPi). I've worked for NASA, built AI systems, compilers, and new computer languages, delved into cryptography and computer security, and am now building a fun mobile phone app for the fitness community.


15h
comment Does too long a salt reduce the security of a stored password hash?
@kasperd Fair enough - I shortened your answer a little bit. ;)
16h
answered HMAC: How unique does a nonce need to be if the Date is also part of the signature?
17h
awarded  Supporter
17h
comment Does too long a salt reduce the security of a stored password hash?
Just use a Salt the length of the hash code, it matches the max entropy of the hash and the password. Longer Salts do no good. Why worry about the storage size of the salt column in your (no)SQL storage? Total salt bytes grows linear with the size of your user base, which, in any realistic working system should be small compared to the amount of data stored for each (all) users. Sizeof(Authentication Data) << Sizeof(All other System Data).
17h
comment Does too long a salt reduce the security of a stored password hash?
A monotonically increasing sequence is guaranteed to be globally unique (1, 2, 3, ...). I don't think this is the "only property" that's important. Use a randomly generated Salt the same length as the password hash and you're highly likely to not only have a system-wide unique salt, but a world wide unique salt.
17h
comment Does too long a salt reduce the security of a stored password hash?
Why stop at 16 hex? That's only 64 bits of entropy for the salt and low enough to encounter some salt repeats, however, unlikely. Just set Salt Length to the same length as the hash output. Longer salts have no more entropy, by definition, shorter salts have less entropy, less effective. Finally, storage cannot be an issue. Whatever the s/w is doing, it requires more storage than some simple old user authentication bits.
Sep
24
awarded  Autobiographer
Oct
8
awarded  Teacher
Oct
8
answered create a variants of MD5