Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

The slowness generally is configurable parameter ("work factor" or some such) and the value is a trade-off between security and usability. The choice of KDF does not really enter into the picture, I think all of mainstream ones can be configured to be fast enough for mobile devices.


Is there any real advantage to using, say, scrypt or Argon2 if you're going to be turning its work factor down to "PBKDF2 level" anyway? I could be wrong, but seems like diminishing returns. From a practical point of view, PBKDF2 ain't broke and is already available out of the box almost everywhere.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: