Removed x86 assembler optimizations since we want bcrypt to be slow

github.com

22 points·valievkarim··7 comments

I guess they don't know what they're doing. You never want your password storage function to have slow code. You want it to require computational power in general, not to needlessly burn your own CPUs.

Making your version of bcrypt slow just means your use slows down. An attacker isn't going to use the broken version.

There's a ";)" smiley in the commit message so it's not the real reason. But I think they should have said the real reason, because lots of people are going to miss the ;) and quote them without it.

I would consider putting deliberately misleading information in the comment of a git commit as "they don't know what they are doing", but that is just me.

This is sarcasm / a joke. Unfortunately, a number of people will take it seriously and post annoying comments on the github and here on HN, and it will cause a bunch of pain for the maintainers. Flagging.

I don't get it. Can someone explain?

bcrypt is a hashing algorithm used for authentication (transforming a plaintext password to a set of deterministic but random bits, for storage and future comparison). The idea being that it is very CPU intensive. Thus dictionary like attacks against it are not very effective, because it requires lots of time to calculate single hashes.

They removed code that sped it up (cpu register optimizations it looks like), which is silly for multiple reasons. The most important one being attackers can just download the bcrypt code and add this back in.

It's over a year old.

Reply on news.ycombinator.com