Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

proposal: x/crypto/scrypt: make API match x/crypto/bcrypt #16971

Open
elithrar opened this issue Sep 2, 2016 · 5 comments
Open

proposal: x/crypto/scrypt: make API match x/crypto/bcrypt #16971

elithrar opened this issue Sep 2, 2016 · 5 comments
Assignees
Milestone

Comments

@elithrar
Copy link

@elithrar elithrar commented Sep 2, 2016

Summary: The x/crypto/scrypt package has a very simple API that puts the onus of figuring out salt generation and sensible N/r/p values on the package user. We should attempt to mirror the bcrypt packages' API and provide sensible defaults.

Details:

  • Add a GenerateFromPassword function that generates output in the form N$r$p$salt$dk (noting that there is no 'standard' for scrypt here)
  • Add a CompareHashAndPassword function
  • Add a Cost function that can return the cost of a given output (i.e. for determining whether to upgrade or not)
  • Provide sensible default params that provide reasonable values of N, r, p and document why/when you may wish to change them.
  • Potentially provide a way to automatically determine values of N, r, p given memory (MB) and time (ms) constraints.

Note that I've done most of this work in https://godoc.org/github.com/elithrar/simple-scrypt and would seek to bring most of this in.

@adg

This comment has been minimized.

Copy link
Contributor

@adg adg commented Oct 3, 2016

Seems reasonable to me, but @agl should take a look.

@bradfitz

This comment has been minimized.

Copy link
Member

@bradfitz bradfitz commented Nov 7, 2016

Ping @agl.

@rsc rsc changed the title Proposal: Make x/crypto/scrypt API match x/crypto/bcrypt proposal: x/crypto/scrypt: make API match x/crypto/bcrypt Nov 7, 2016
@gopherbot gopherbot added the Proposal label Mar 20, 2017
@kevinburke

This comment has been minimized.

Copy link
Contributor

@kevinburke kevinburke commented Oct 5, 2017

puts the onus of figuring out salt generation and sensible N/r/p values on the package user.
Provide sensible default params that provide reasonable values of N, r, p and document why/when you may wish to change them.

I just added some better documentation here, so hopefully this is better now.

Add a GenerateFromPassword function that generates output in the form N$r$p$salt$dk (noting that there is no 'standard' for scrypt here)

I'd feel uncomfortable publishing this without having some sort of standard present on the scrypt website. You could ask Colin Percival if he is interested in it.

Add a CompareHashAndPassword function

This would be reasonable but we'd need to figure out what the hash input should be.

Add a Cost function that can return the cost of a given output (i.e. for determining whether to upgrade or not)

The API for bcrypt takes a []byte but []byte is also the output from scrypt.Key. You'd have to know to use the GenerateFromPassword output instead.

@elithrar

This comment has been minimized.

Copy link
Author

@elithrar elithrar commented Oct 6, 2017

Thanks for taking a look at this @kevinburke (I'd forgotten myself)

I'd feel uncomfortable publishing this without having some sort of standard present on the scrypt website. You could ask Colin Percival if he is interested in it.

Noted. I pinged Colin on Twitter, and as there isn't a specified output format (there isn't in the paper), have asked if there's any intent to specify. Unlikely, but doesn't hurt to ask.

The other two points are somewhat held up on a standard format. The alternative would be to return a struct of the params for the caller to then stringify as needed.

PS: I did note the improved params "for 2017" CL the other day, which is a good start.

@ianlancetaylor

This comment has been minimized.

Copy link
Contributor

@ianlancetaylor ianlancetaylor commented Mar 19, 2018

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
8 participants
You can’t perform that action at this time.