srcagency / credentials Goto Github PK

The initial argument for the expired method was to allow for continuous rehashing of passwords on sign up as they became too weak (as defined by days).

The problem with the current expired method is that it is actually cumbersome to use in practice during a sign in, as you would have to hash the same password twice given the way verify works.

I am not clarified about this.

http://security.stackexchange.com/questions/3272/password-hashing-add-salt-pepper-or-is-salt-enough

Test the impact on hashing performance.

If you try to verify hashes generated by [email protected] the verify function with return false.

This can be easily replicated by running the following code on Runkit:

https://runkit.com/embed/zgp4an2ckb58

In case Runkit doesn't work, you can try to verify the following hash with 3.0.2:

{"salt":"8Nqw3LkHwILdMvZaibpFUGyVeMqYi5KsZwUqF9Esxnlkxt/tjEmO0Hjmdjqm6/FezgSfHrIoUQTyinsKJxvR6GJt","hash":"lXXvFBZecCsmyX+A/24TWVvvNTaixBLdYQD0sGSKNaAj58u4TXQBwI8vCFTwy0xsDHvsczoHKZufNoai1uxr1+3t","keyLength":66,"hashMethod":"pbkdf2","iterations":919715}

password is "foo".

Taylor Hornby (https://twitter.com/DefuseSec) has offered to do a security review of this library: https://twitter.com/tjconceptdk/status/607203601740660736

I hope he will also be able to answer whether we need a constant time comparison at all.