Subject: Re: [kitten] Password KDF settings on draft-ietf-kitten-password-storage-01

From: "Sam Whited" <[email-masked]>
Date: Sun, 01 Nov 2020 05:10:45 -0500

On Sat, Oct 31, 2020, at 21:01, [email-masked] wrote:
> Note that the recommendation from OWASP for bcrypt was briefly changed
> to cost 12 by one person and switched back to cost 10. Their defense
> cited your draft as why to keep it at cost 12. Until I pointed out
> that they are now citing each other.

Oh yes, that's definitely not good; the document I see
(https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html#bcrypt)
still shows 12 though, do they have other recommendations listed
somewhere else?

> Only PBKDF2 says that the settings are a minimum.

Oops, I thought I updated all these values but I guess I missed them.
Sorry about that, will fix with the next draft. Thanks!

—Sam

---

From: [email-masked]
Date: Tue, 3 Nov 2020 18:56:35 -0600 (CST)

Oops I didn't reply on list:

> On 11/03/2020 5:39 PM [email-masked] wrote:
> 
>  
> > On 11/01/2020 4:10 AM Sam Whited <[email-masked]> wrote:
> > 
> >  
> If you are taking bcrypt cost 12 from OWASP, then you should take PBKDF2 100,000 iterations too. Since those are the "well if you can, go for these numbers". Just a reminder bcrypt cost is exponential so cost 12 is 16 times harder than cost 8 and cost 8 is equivalent to PBKDF2-SHA256 300,000 iterations. Note both cost 8 and 300,000 iterations are just over 10 kH/s/GPU thus are considered not good.
> 
> "The default work factor for Bcrypt is 10, and this should generally be raised to 12 unless operating on older or lower-powered systems."
> 
> "The work factor for PBKDF2 is implemented through the iteration count, which should be at least 10,000 (although values of up to 100,000 may be appropriate in higher security environments)."