lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
Hash Suite for Android: free password hash cracker in your pocket
[<prev] [next>] [day] [month] [year] [list]
Date: Thu, 21 Aug 2014 19:08:53 -0400
From: Bill Cox <>
To: "" <>
Subject: Should we revisit the password hashing framework idea?

After seeing a couple of the presentations, I see that some people are
focusing a lot on various bells and whistles which are not fundamental
features of the various entries.  For example, any of the schemes can have
an external wrapper to convert a single string from a data base into
parameters for a PHS function call.  This sounds very useful to real users,
and it needs to be implemented securely, it is not a fundamental part of a
password hashing scheme.  Similar bells and whistles which are easily added
in an external framework include support for very long passwords, very long
variable output keys,  etc.

Would it make sense to build a framework with some of these features?


Content of type "text/html" skipped

Powered by blists - more mailing lists