Reputation
Top tag
Next privilege 200 Rep.
See reduced ads
Badges
6
Impact
~2k people reached

  • 0 posts edited
  • 0 helpful flags
  • 1 vote cast
Sep
25
comment BCrypt's 72-character limit and using it as a general digest algorithm
I was (this question is pretty old now) asking for implementation steps, and in that sense there is nothing wrong with the answer - but you depart very significantly from the question and give no reasons for doing so. Giving those reasons (as, for instance, the accepted answer did) would help make it a more useful answer, even without my wanting to "debate" the best practices.
Sep
23
comment BCrypt's 72-character limit and using it as a general digest algorithm
Regarding "without" etc. - you then say "here's a better cookbook" which implies that you will go do "something else". As for confidentiality and AE, well, that should be part of the answer, then... ideally in more detail than just a link to a wiki page.
Sep
22
comment BCrypt's 72-character limit and using it as a general digest algorithm
Your first sentence makes it sound like you want to suggest storing the session info server-side, which violates the assumption in sentence 1 of the question I asked. Then your "cookbook" basically says "use encryption [instead of hmac as suggested in the accepted answer]" to be able to verify session info, without explaining why. The answer would be a lot more appropriate if it provided more reasoning for either suggestion.
Mar
16
awarded  Popular Question
Aug
29
awarded  Nice Question
Oct
13
awarded  Scholar
Oct
13
accepted BCrypt's 72-character limit and using it as a general digest algorithm
Oct
12
awarded  Supporter
Oct
12
comment BCrypt's 72-character limit and using it as a general digest algorithm
As for "iPhone syndrome": ouch. I disagree, but I see your point. SHA-3 was an example; surely NIST isn't themselves saying that it's worse than SHA-2, either? The reason I didn't go with HMAC+SHA-2 to begin with (I'm aware rolling your own is a bad idea) was that in my limited searching around, there were concerns about it after the SHA-1 issues that surfaced, hence looking further. Searching some more it seems those concerns have faded somewhat now that quite some time has passed and nothing horrible has reared its head. Would you say the latter is an accurate summary?
Oct
12
comment BCrypt's 72-character limit and using it as a general digest algorithm
Thanks for weighing in with the clear pointers. Some questions: I opted for BCrypt not so much for 'slow' as much as for 'can be made slow enough for bruteforce not to be viable', even as technology progresses. If I understand, you're saying: as the secret is controlled, increase the entropy of the secret rather than the 'slowness' of the algorithm, in order to achieve the same resistance, correct? Regarding the confidentiality: I don't really understand the link to the question; what am I missing? Do you think some of the plaintext used for the MAC should be confidential?
Oct
12
awarded  Student
Oct
12
asked BCrypt's 72-character limit and using it as a general digest algorithm
Oct
12
awarded  Autobiographer