Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Cryptography introduction: hash algorithm recommendations outdated #59

Open
felixauringer opened this issue Oct 14, 2024 · 0 comments
Open

Comments

@felixauringer
Copy link

The section about prominent hash algorithms does not include modern password hashing algorithms.

Nowadays, there are hashing algorithms designed explicitly for hashing passwords. Those also have parameters to require more computations and/or memory (which does not scale well) in order to make bruteforce attacks harder. Examples are argon2id and yescrypt (the former won the Password Hashing Competition). You describe password hashing as a use case for cryptographic hashes but only mention algorithms that are not suitable for this purpose.


You also say that MD5 is still useful. However, because of existing attacks (e.g. missing collision resistance), MD5 is obsolete and should not be used at all. For other use cases (not related to password hashing), there are other very fast algorithms without known attacks that should be preferred. Examples are SHA-2 or SHA-3.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant