Comments (6)
Why does hiding the iteration count make it difficult to implement in another language?
from credential.
How am I going to implement it in another language without knowing the iteration count? The user of this module is not going to know the actual number of iterations without reading the source and obfuscating whatever you're intending to do with work_key
.
from credential.
I've actually implimented my own version of this called co-crypto-saltedhash
from credential.
Your default iterations are dangerously low. Even cheap commodity hardware would be able to crack those hashes too quickly. You need closer to 60,000 iterations to get into safe territory for 2014, and next year, the standard will be different, so it's important that it's easy to reconfigure without breaking existing passwords (safest way). If you have to break user passwords, you'll have to have a secure password change mechanism to prevent user lock-outs.
That's why credential includes all the information necessary (minus the work secret) to check the hash:
{
hash: hash,
salt: salt,
keyLength: keyLength,
hashMethod: hashMethod,
workUnits: workUnits
}
All this gets stored with the passwords. That way you can easily move the work units to keep up with changing technology without locking users out. Just remind them to change their password when they log in if they're using the outdated work unit standard.
Credential hides the work secret by default (though it does have a sensible fallback if you don't want to use that feature) because of security in layers. It's that much harder to breach the password database if you have no idea how many iterations to try.
from credential.
I would not recommend rolling your own solution for this stuff. Credential was audited by as many security professionals as I could find before it was published, and I'm still nervous about it, for good reason. Password security is currently one of the largest weaknesses in online security -- a much more dangerous threat than even the most sophisticated XSS or injection attacks, because of the potential impact if there's a password database theft. Proceed with caution.
from credential.
BTW, your verify function is vulnerable to a variable time equality attack.
from credential.
Related Issues (20)
- callback, promise or both HOT 10
- I can't make the cli work HOT 8
- Verifying with a pre-parsed JSON object HOT 4
- What if an attacker know that I am using this library? HOT 9
- The use of "time" - a weakness worth noting? HOT 13
- Why hash() just return string rather than object? HOT 2
- fix failing CI server
- Does it really needs webpack? HOT 7
- Node v6 deprecation - "crypto.pbkdf2 without specifying a digest is deprecated" HOT 3
- Release v2.0.0 on npm HOT 3
- Support bcrypt hashing method? HOT 1
- performance optimisation HOT 4
- Make errors programmatically processable HOT 7
- Do not encourage people to write security issue in public places HOT 1
- Default number of iterations seems extreme HOT 2
- Due to the large number of iterations, Its consuming the full CPU usage. HOT 7
- Update deps, freshen code, release new major version. HOT 7
- Bad default settings HOT 4
- the 'verify' function takes too much time, about 1.3 seconds HOT 2
- Inconsistent use of bytes length/encodings? HOT 3
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from credential.