Thomas Hartman wrote:
> http://hackage.haskell.org/cgi-bin/hackage-scripts/package/PBKDF2
>
> Since no one took up my code review request I just did the best I
> Also I'm open to folding this into a more established crypto package
> if there are any takers... psst, dominic.
I've now had chance t
Thomas Hartman wrote:
> http://hackage.haskell.org/cgi-bin/hackage-scripts/package/PBKDF2
>
> Since no one took up my code review request I just did the best I
> could and uploaded to hackage. There were indeed some mistakes in my
> initial post, fixed now. (Code review is still wished, though!)
>
http://hackage.haskell.org/cgi-bin/hackage-scripts/package/PBKDF2
Since no one took up my code review request I just did the best I
could and uploaded to hackage. There were indeed some mistakes in my
initial post, fixed now. (Code review is still wished, though!)
Alas, documentation doesn't buil
Sorry about the hideous formatting above. Reattached as a text file.
t.
2008/11/26 Thomas Hartman <[EMAIL PROTECTED]>:
> OK, I went ahead and implemented pbkdf2, following the algorithm
> linked to by bulat and Michael.
>
> If there are any crypto gurus who can code-review this I would be much
>
What you are using there is not a salt, but rather a secret key. The
important thing about a salt is that it is different for _every user_.
and you actually store the salt unhashed along with the hash. (it is not
secret information). A salt protects against a dictionary attack, for
instance, you mi
OK, I went ahead and implemented pbkdf2, following the algorithm
linked to by bulat and Michael.
If there are any crypto gurus who can code-review this I would be much
obliged, and when I'm confident enough that this does the right thing
I'll put it up on hackage.
I don't do much crypto so this *
Hello Thomas,
Tuesday, November 25, 2008, 9:13:53 PM, you wrote:
don't reinvent the wheel, use PBKDF2 from PKCS #5
http://www.truecrypt.org/docs/pkcs5v2-0.pdf
> How about the following?
> The main doubts I'm having at this point concern the takerandom part.
> Does this seem reasonable?
> Also,
8:38 AM
To: Bulat Ziganshin; haskell-cafe; HAppS
Subject: Re: Re[2]: [Haskell-cafe] Password hashing
What does haskell cafe think of the following module for drop-in
password hasing for webapps? Seem reasonable?
import Data.Digest.SHA512 (hash)
import qualified Data.ByteString as B'
import
How about the following?
The main doubts I'm having at this point concern the takerandom part.
Does this seem reasonable?
Also, someone in the thread mentioned that a calculation that took a
couple of seconds to complete was a good thing because it makes
dictionary cracking harder. But
makeSalte
ah thanks, I'll try again.
> typical salt usage is generation of new salt for every encryption
>operation and storing together with encrypted data
2008/11/25 Bulat Ziganshin <[EMAIL PROTECTED]>:
> Hello Thomas,
>
> Tuesday, November 25, 2008, 6:39:27 PM, you wrote:
>
>> Just to note, the comment
Bulat Ziganshin wrote:
Just to note, the comment about md5 is incorrect. I switched to SHA512
as you can see in the code.
really? :)
Right s -> -- return . show . md5 . L.pack $ p ++ s
Yes, really. If you look carefully, it is commented out. ;)
- Jake
signature.asc
Description: OpenP
Hello Thomas,
Tuesday, November 25, 2008, 6:39:27 PM, you wrote:
> Just to note, the comment about md5 is incorrect. I switched to SHA512
> as you can see in the code.
really? :)
>>Right s -> -- return . show . md5 . L.pack $ p ++ s
typical salt usage is generation of new salt for every en
Just to note, the comment about md5 is incorrect. I switched to SHA512
as you can see in the code.
2008/11/25 Thomas Hartman <[EMAIL PROTECTED]>:
> What does haskell cafe think of the following module for drop-in
> password hasing for webapps? Seem reasonable?
>
> import Data.Digest.SHA512 (hash)
What does haskell cafe think of the following module for drop-in
password hasing for webapps? Seem reasonable?
import Data.Digest.SHA512 (hash)
import qualified Data.ByteString as B'
import qualified Data.ByteString.Char8 as B
-- store passwords as md5 hash, as a security measure
scramblepass ::
On 2008 Oct 30, at 9:12, roger peppe wrote:
i'd be interested to know if you know of any studies on this.
i know of at least one system that uses it as the basis for
its crypto. superficially it's certainly an attractive method, with
minimal
external dependencies, and, i'd have thought, at le
On 2008 Oct 30, at 8:43, Martijn van Steenbergen wrote:
roger peppe wrote:
if you're prepared to expend a few cpu cycles, you can always
use something like the following "beating clocks" algorithm, which
should generate
at least some genuine randomness, as long as you've got preemptive
schedulin
to expand on this:
Bulat Ziganshin wrote:
> 1) without salt, it's not serious - easily breaked by dictionary
> attack
and this:
Thomas Schilling wrote:
> In general, it is recommended that password hash functions are
> comparatively *slow* in order to make offline attacks harder. You can
> some
Hello Thomas,
Thursday, October 30, 2008, 3:32:46 PM, you wrote:
> No salt, but apart from that, should be fine, right?
1) without salt, it's not serious - easily breaked by dictionary
attack
2) afair, md5 isn't condidered now as cryptographic hash
--
Best regards,
Bulat
roger peppe wrote:
if you're prepared to expend a few cpu cycles, you can always
use something like the following "beating clocks" algorithm, which
should generate
at least some genuine randomness, as long as you've got preemptive
scheduling, and a few hardware interrupts around the place.
I wa
i'd be interested to know if you know of any studies on this.
i know of at least one system that uses it as the basis for
its crypto. superficially it's certainly an attractive method, with minimal
external dependencies, and, i'd have thought, at least a useful
addition to just using the system ti
In my happs-tutorial application I do the following to keep passwords.
No salt, but apart from that, should be fine, right?
thomas.
**
import qualified Data.ByteString.Char8 as B
import qualified Data.ByteString.Lazy.Char8 as L
-- store passwords as md5 hash, as a security measure
scra
if you're prepared to expend a few cpu cycles, you can always
use something like the following "beating clocks" algorithm, which
should generate
at least some genuine randomness, as long as you've got preemptive
scheduling, and a few hardware interrupts around the place.
>module Clockbeat where
>i
Please be careful not to invent or reinvent a password hashing scheme.
I'd go with bcrypt. That'd be a worthy module.
___
Haskell-Cafe mailing list
Haskell-Cafe@haskell.org
http://www.haskell.org/mailman/listinfo/haskell-cafe
In general, it is recommended that password hash functions are
comparatively *slow* in order to make offline attacks harder. You can
somewhat emulate this by running the hashing function multiple times.
And, of course, salting should always be done.
2008/10/28 Bulat Ziganshin <[EMAIL PROTECTED]>:
Hello Bit,
Wednesday, October 29, 2008, 4:32:51 PM, you wrote:
>> It's a good idea to salt your passwords before hashing, though. See
> What can be used for generating a random salt? Is System.Random secure enough?
if you use mkStdRNG it's good enough for non high-secure programs. it
inits rnd g
On Tue, Oct 28, 2008 at 5:56 PM, Michał Pałka <[EMAIL PROTECTED]> wrote:
> It's a good idea to salt your passwords before hashing, though. See
> http://en.wikipedia.org/wiki/Salt_(cryptography)
What can be used for generating a random salt? Is System.Random secure enough?
Thanks
_
bulat.ziganshin:
> Hello Bit,
>
> Tuesday, October 28, 2008, 6:42:34 PM, you wrote:
>
> > What library can be used to securely hash passwords? From what I
>
> any secure hash, say SHA512
And there are multiple bindings and implementations of SHA on
hackage.haskell.org.
nano-hmac provides a bin
On Tue, Oct 28, 2008 at 16:42, Bit Connor <[EMAIL PROTECTED]> wrote:
> Hello,
>
> What library can be used to securely hash passwords? From what I
> understand, the "bcrypt" algorithm is what the experts recommend. It
> is described in the paper:
>
> http://www.openbsd.org/papers/bcrypt-paper.ps
>
On Tue, 2008-10-28 at 18:49 +0300, Bulat Ziganshin wrote:
> Tuesday, October 28, 2008, 6:42:34 PM, you wrote:
>
> > What library can be used to securely hash passwords? From what I
>
> any secure hash, say SHA512
It's a good idea to salt your passwords before hashing, though. See
http://en.wikip
Hello Bit,
Tuesday, October 28, 2008, 6:42:34 PM, you wrote:
> What library can be used to securely hash passwords? From what I
any secure hash, say SHA512
--
Best regards,
Bulatmailto:[EMAIL PROTECTED]
___
Haskell-Cafe
Hello,
What library can be used to securely hash passwords? From what I
understand, the "bcrypt" algorithm is what the experts recommend. It
is described in the paper:
http://www.openbsd.org/papers/bcrypt-paper.ps
I couldn't find a haskell library for this.
There is a BSD licensed C implementat
31 matches
Mail list logo
