davidmurdoch / easy-pbkdf2 Goto Github PK

The default of 512 is laughably low. Consider using 64,000 iterations, with automatic doubling every 2 years since 2012.

Apparently 64,000 iterations was recommended by OWASP in 2012, with the recommendation that this value double every 2 years. I couldn't find the source for this though, and I'll need to benchmark a bit to ensure I don't cause sites to DOS themselves in a few years.

Being that this is supposed make pbkdf2 "easy" I should probably add a verify method.

is there a reason why:
var keySize = 256,

is hardcoded in the hash function? couldn't this be configurable like SALT_SIZE?

http://www.reddit.com/r/cryptography/comments/1l9b6o/question_should_different_implementations_of/

i had some trouble using your library that boiled down to the salt encoding, and this thread might illuminate things a little for you. I think I followed all the examples I could find correctly, but maybe you want to make your documentation reflect this subtlety. I'd be happy to provide additional info if you need.

Also, when will the KEY_SIZE fix make it into your npm module?

Hello,

I'm unable to instantiate easyPbkdf2 with options. This is how I'm calling it:

var EasyPbkdf2 = require('easy-pbkdf2')();

// Configure easyPbkdf2
var options = {
    'DEFAULT_HASH_ITERATIONS': 512,   // default DEFAULT_HASH_ITERATIONS is 512
    'SALT_SIZE': 32                   // default SALT_SIZE is 32
};

var easyPbkdf2 = new EasyPbkdf2(options); <<<<< crashes here
console.log(easyPbkdf2.DEFAULT_HASH_ITERATIONS); // 256
console.log(easyPbkdf2.SALT_SIZE); // 16

I never get to see the console.logs because Node throws the following exception:

TypeError: object is not a function

If I call easyPbkdf2.secureHash() without options, it works great. Any ideas? Thanks!

DOS attacks via long passwords will probably be making their rounds (again). http://www.tomsguide.com/us/django-long-password-security,news-17557.html

I'm thinking about setting a default max-length of maybe 4096 bytes. This max-password length would be configurable.