1

This question already has an answer here:

It is generally recommended that one use a slow hash function to hash passwords. However, does this create a DoS risk?

marked as duplicate by John Deters, Trey Blalock, TheJulyPlot, Anders, Stephane Mar 27 '17 at 8:33

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

migrated from crypto.stackexchange.com Feb 4 '16 at 7:40

This question came from our site for software developers, mathematicians and others interested in cryptography.

2

You could, in addition to using a slow hash function, limit the number of requests per second a particular user could send. For instance, if you're getting 30 failed login requests from a particular IP address, then you could delay the responses to that address, or drop them all together.

Slowing hash functions is designed to make it impractical to carry out a brute force attack if an attacker gets access to the password database. There should still be precautions built into the server as well.

Not the answer you're looking for? Browse other questions tagged or ask your own question.