Hacker News Reader

HNHacker News

Top New Best Ask Show Jobs

Comment by tptacek | Hacker News Reader

Full thread

tptacek·

the top options being bcrypt, scrypt, PBKDF2, or SHA-2

Thanks, CSO Magazine!

View on HN

Why is SHA-2 in the list? [Looks like cperciva beat me to it, 0 minutes ago]

Something I've always wondered about SHA and MD5, though: if you feed the output of a hash function into its input enough times, will you eventually reach the original value? Will you have traversed the entire output space of the hash, or will there be multiple closed loops, or perhaps even multiple starting points converging on a single terminal loop?

There has to be at least one loop (or fixed point that maps to itself). There's only a finite set of outputs, and the input space of strings as long as a hash is at least that large (in theory, some output hashes may not be possible to generate). Ideally you'd have very large, long loops, which implies few collisions.

At least one loop, but it could be the trivial one (ideally?): take the trivial case where the hash is simply a unit cyclic shift of the first N-bits -- there's just the full loop.

For x << 2^(N/2) and a random oracle H which produces an N-bit output, H^x has approximately N - log(x) bits of entropy.

So it is a real issue, but not one which is serious enough to matter in practice. This is, however, why we use PBKDF2 instead of PBKDF1.

One of those does not belong on that list...

And it isn't scrypt :)

They forgot to mention cereal encoding rings.

> or SHA-2

Nice try, General Alexander.

Reply on news.ycombinator.com