{"id":2707,"date":"2019-10-04T21:26:49","date_gmt":"2019-10-05T01:26:49","guid":{"rendered":"http:\/\/ninecrows.com\/career\/?p=2707"},"modified":"2019-10-04T09:36:01","modified_gmt":"2019-10-04T13:36:01","slug":"fun-with-password-hashing","status":"publish","type":"post","link":"https:\/\/ninecrows.com\/career\/2019\/10\/04\/fun-with-password-hashing\/","title":{"rendered":"Fun with Password Hashing"},"content":{"rendered":"\n
\"\"<\/figure><\/div>\n\n\n\n

I’ve been spending some time looking into password hashing best practices over the last week.<\/p>\n\n\n\n

I’ve know about the BCrypt <\/a>algorithm for a long time as the old BSD standard ‘high effort’ hashing algorithm designed to make brute forcing hashes difficult.<\/p>\n\n\n\n

I’ve found that there is a new effort called SCrypt <\/a>intended to generate a modern equivalent for dedicated password hashing as well as a ‘password expansion’ algorithm that appears to be in wide used called PBKFD2<\/a>.<\/p>\n\n\n\n

The PBKDF2 algorithm applies an HMAC <\/a>using the key input to inject the salt and then to chain iterations of the process. It takes a user selected number of iterations that allows the work-load to generate the hash to be tuned to the scope of expected attacks (and to the performance of the target hardware). This allows modern high performance algorithms such as SHA-256 to be applied in a manner that makes the total calculation of the final salted hash resource intensive enough to reduce the likelihood of a successful brute force attack.<\/p>\n\n\n\n

<\/p>\n","protected":false},"excerpt":{"rendered":"

I’ve been spending some time looking into password hashing best practices over the last week. I’ve know about the BCrypt algorithm for a long time as the old BSD standard ‘high effort’ hashing algorithm designed to make brute forcing hashes difficult. I’ve found that there is a new effort called SCrypt intended to generate a … Continue reading Fun with Password Hashing<\/span> →<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","enabled":false},"version":2}},"categories":[3,19,7],"tags":[],"class_list":["post-2707","post","type-post","status-publish","format-standard","hentry","category-ideas","category-security","category-topics"],"jetpack_publicize_connections":[],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"jetpack_shortlink":"https:\/\/wp.me\/p7F2Qc-HF","jetpack-related-posts":[],"jetpack_likes_enabled":true,"_links":{"self":[{"href":"https:\/\/ninecrows.com\/career\/wp-json\/wp\/v2\/posts\/2707"}],"collection":[{"href":"https:\/\/ninecrows.com\/career\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ninecrows.com\/career\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ninecrows.com\/career\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/ninecrows.com\/career\/wp-json\/wp\/v2\/comments?post=2707"}],"version-history":[{"count":2,"href":"https:\/\/ninecrows.com\/career\/wp-json\/wp\/v2\/posts\/2707\/revisions"}],"predecessor-version":[{"id":2709,"href":"https:\/\/ninecrows.com\/career\/wp-json\/wp\/v2\/posts\/2707\/revisions\/2709"}],"wp:attachment":[{"href":"https:\/\/ninecrows.com\/career\/wp-json\/wp\/v2\/media?parent=2707"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ninecrows.com\/career\/wp-json\/wp\/v2\/categories?post=2707"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ninecrows.com\/career\/wp-json\/wp\/v2\/tags?post=2707"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}