[tor-dev] Hmac

[dawuud]

scrypt is a key derivation function... the other is not. why compare them?
they are both good for different things, are they not?

here lemme google that for you
https://en.wikipedia.org/wiki/Hash-based_message_authentication_code
https://en.wikipedia.org/wiki/Key_derivation_function


On Fri, Sep 09, 2016 at 08:24:09PM -0400, Jesse V wrote:
> On 09/09/2016 07:28 PM, Flipchan wrote:
> > Hi all, so i spook with a friend of mine yesterday and we where chating
> > about encryption and i told him that i use scrypt for password hashing.
> > He told that hmac was alot better.
> > 
> > Does anyone know any Good whitepapers on hmac? Any Good python lib? Does
> > anyone use it ?
> 
> The important thing here is that in this context, both scrypt and HMAC
> receive two values: a password and a salt. This provides a defense
> against rainbow tables if your database is compromised. It also avoid
> leaking whether two users have the same password. The idea is to store
> the username, salt, and hashed password in the database.
> 
> Scrypt is useful because it's memory-hard, which means that it better
> resists hardware attacks since the scrypt operation requires precious
> RAM. HMAC is useful because it isn't safe to compute SHA2(salt +
> password) due to the Length Extension Attack against MD5, SHA1, and
> SHA2, but this doesn't necessarily apply in this context. When you say
> "HMAC", I assume that your friend means HMAC_SHA256.
> 
> HMAC_SHA256 is very common for storing passwords and there are many
> papers, libraries, and other resources on it. I would start with the
> Wikipedia article on HMAC and go from there. If you really want to dig
> into the topic, look into Argon2.
> 
> -- 
> Jesse V
> 




> _______________________________________________
> tor-dev mailing list
> tor-dev at lists.torproject.org
> https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-dev

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 801 bytes
Desc: not available
URL: <http://lists.torproject.org/pipermail/tor-dev/attachments/20160910/2cc4404d/attachment.sig>