Timeline for Does complexity of salt in password hashing matter?
Current License: CC BY-SA 4.0
3 events
when toggle format | what | by | license | comment | |
---|---|---|---|---|---|
Nov 10, 2020 at 13:46 | comment | added | user1067003 |
@BrianDrake well 10 bytes is way more than enough, but i don't know what the lower limit is (maybe even 4 bytes is good enough, i don't know, but i know that 10 more than enough), as for /dev/urandom , i meant the concept of /dev/urandom: cryptographically secure random bytes , regardless of the source (/dev/urandom is just a famous source - less famous sources include the linux api getrandom, the windows api CryptGenRandom, the openssl api RAND_bytes, etc)
|
|
Nov 10, 2020 at 13:32 | comment | added | Brian Drake | Why do you make this very specific recommendation: “10 bytes of /dev/urandom”? Why 10 bytes? What if the developer is using a high-level language where there is a better way of getting entropy? | |
Nov 10, 2020 at 13:27 | history | answered | user1067003 | CC BY-SA 4.0 |