phc-discussions - Should we revisit the password hashing framework idea?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <CAOLP8p5joyDQe86LO67sEZxYqWQE8pDf_YyjhD02AMxu0Gc9HQ@mail.gmail.com>
Date: Thu, 21 Aug 2014 19:08:53 -0400
From: Bill Cox <waywardgeek@...il.com>
To: "discussions@...sword-hashing.net" <discussions@...sword-hashing.net>
Subject: Should we revisit the password hashing framework idea?

After seeing a couple of the presentations, I see that some people are
focusing a lot on various bells and whistles which are not fundamental
features of the various entries.  For example, any of the schemes can have
an external wrapper to convert a single string from a data base into
parameters for a PHS function call.  This sounds very useful to real users,
and it needs to be implemented securely, it is not a fundamental part of a
password hashing scheme.  Similar bells and whistles which are easily added
in an external framework include support for very long passwords, very long
variable output keys,  etc.

Would it make sense to build a framework with some of these features?

Bill

Content of type "text/html" skipped