phc-discussions - Re: [PHC] A review per day

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Sun, 14 Sep 2014 04:31:04 -0700
From: epixoip <epixoip@...dshell.nl>
To: discussions@...sword-hashing.net
Subject: Re: [PHC] A review per day - Battcrypt

On 9/14/2014 3:42 AM, Bill Cox wrote:
>
> On 09/14/2014 04:54 AM, Solar Designer wrote:
> > I think reducing the number of Blowfish rounds defeats the point
> > of using battcrypt anyway.  battcrypt is primarily to be
> > implemented using a scripting language's calls to a native
> > implementation of Blowfish, so it usually won't be able to tweak
> > the Blowfish rounds count.
>
> Ah, I see.  That is a blow against PufferFish then, isn't it?
> PufferFish upgraded the hashing to 64-bit, which will be incompatible
> with PHP's BlowFish.

No, Pufferfish doesn't claim to be scripting language-friendly. If one
were to integrate Pufferfish into PHP, it would best be accomplished
with an extension or patch. It's not like bcrypt in PHP is implemented
in native PHP.