lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
Hash Suite for Android: free password hash cracker in your pocket
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 3 Sep 2014 13:16:37 +0200
From: Krisztián Pintér <>
To: "" <>
Subject: Re: [PHC] Second factor (was A review per day - Schvrch)

On Wed, Sep 3, 2014 at 12:43 PM, Bill Cox <> wrote:
> Second factor is something that I think a lot of entries with a secret
> key or local parameter or data field.

adding 128 bit or 256 bit secret key is easy. adding megabytes of
secret data is not that easy. i can add up to m_cost words of secret
data, and the derived key is pseudorandom on every single bit of it.
it is also not possible to compress the secret data, you really need
all of it.

that said, i don't think that it is a very important feature, i added
anyway because with my algorithm, it is almost free, has negligible
cons, so why the hell not? i have the same reason for the Transform
function. it helps not much, but it also costs near zero. i wouldn't
be surprised if nobody ever used these features.

Powered by blists - more mailing lists