Blockchain Enthusiast (qq:53016353)
Scrypt was developed by the famous FreeBSD hacker Colin Percival for his backup service Tarsnap.
Scrypt not only takes a long time to compute, but also consumes more memory, making it difficult to compute multiple abstracts in parallel, making it more difficult to use rainbow table for brute force attacks. Scrypt is not used extensively in production environments, and lacks careful scrutiny and extensive library support. However, as long as there is no flaw in the algorithm level, the security of scrypt should be higher than PBKDF2 and Bcrypt.
Comparison with other cryptographic algorithms
PBKDF2
PBKDF2 simply means that the salted hash is repeated several times, and this number is selectable. If the time required to calculate is 1 microseconds, it takes 1 seconds to calculate 1 million times. If there are 10 million rainbow table required to attack a password, the time required to establish the corresponding rainbow table is 115 days. The price is enough to make most attackers forget. U.S. government agencies have standardized this approach and are used in a number of government and military systems. The best advantage of this scheme is standardization, which makes it easy to adopt the proven SHA algorithm.
Bcrypt
Bcrypt is an algorithm specifically designed for password storage, based on the Blowfish encryption algorithm, which was published by Niels Provos and David Mazières in 1999 Usenix. The biggest benefit of bcrypt is that there is a parameter (work factor) that can be used to adjust the calculation strength, and the work factor is included in the summary of the output. With the increase in attackers ' computing power, users can incrementally increase work factor without affecting the landing of existing customers. Bcrypt has been carefully analyzed by many security experts, and used in OpenBSD, known for its safety, is generally considered to be more resilient to the risks associated with increased computing power than PBKDF2. Bcrypt also has a wide range of library support, so we recommend storing passwords this way.
The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion;
products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the
content of the page makes you feel confusing, please write us an email, we will handle the problem
within 5 days after receiving your email.
If you find any instances of plagiarism from the community, please send an email to:
info-contact@alibabacloud.com
and provide relevant evidence. A staff member will contact you within 5 working days.
