Tag
6 articles with this tag.
Balloon hashing is a memory-hard password hashing function built from an ordinary hash such as SHA-256. Learn how it expands a buffer, mixes it with salt-driven reads, why its memory access never depends on the password, and what attacks it faces.
16 min read
bcrypt is a password hashing function built from the Blowfish cipher with a deliberately expensive key setup. Learn how the salt, the cost, and the 72-byte limit work, how the hash string is built, and why its versions differ.
20 min read
scrypt is a password-based key derivation function that makes every guess cost memory as well as time. Learn how Salsa20/8, BlockMix, and ROMix fill and read a large table, how its parameters work, and what its security proofs say.
19 min read
Argon2 won the 2015 Password Hashing Competition by making brute-force attacks expensive in RAM, not just CPU time. That closes off the GPU and ASIC cracking farms that broke older schemes. Here's how memory-hardness works.
9 min read
TLS 1.3 and the Signal Protocol both lean on the same small, elegant primitive to turn a shared secret into however many separate keys they actually need. Here's how HKDF's extract-then-expand design works.
8 min read
For nearly two decades, PBKDF2's answer to password cracking was simple: make every guess expensive by repeating a hash thousands of times. Here's how it works, and why memory-hard successors like Argon2 eventually surpassed it.
8 min read
