This question already has an answer here:
- Recommended # of rounds for bcrypt 3 answers
What should the ideal
$cost be in this case to prevent brute force attack even by ASIC or an FPGA
$cost = '06'; $secret_key = bin2hex(random_bytes(64)); $store_data = crypt($secret_key, '$2a$.$cost.$'.bin2hex(random_bytes(16)).'$')
Company gives user
$secret_key which is generated by above code to give access to withdraw some money and this secret key should never be guessed by hacker.
$store_data is the string that we stored in our database.
So if an attacker gets access to the database and learns the
$store_data variable he should not be able to obtain
I have used the bcrypt algorithm to hash but I am not sure if
$cost = 6 is secure enough in this case.
I didn't use
password_hash because I will convert all code into Java in the future and in Java there is no equivalent of