[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

RE: Security


Again I agree with Sam. String-to-key functions that allow attackers to make 10s of millions of password guesses per second on a single PC are definitely not where the world is at today.
Use of iterated hashes to make computation of the key from the password take a few hundred milliseconds really makes a difference -- that's what PBKDF2 does.

-----Original Message-----
From: owner-ietf-sasl@xxxxxxxxxxxx [mailto:owner-ietf-sasl@xxxxxxxxxxxx] On Behalf Of Sam Hartman
Sent: Wednesday, August 13, 2008 10:56 AM
To: Frank Ellermann
Cc: ietf-sasl@xxxxxxx
Subject: Re: Security

My problem is not with HMAC, but with the lack of PBKDF2.  Note that I
am acting on my proposals by contributing to scram.