Password Hashing Reference
Reference 为 password 哈希 schemes: bcrypt, scrypt, Argon2, PBKDF2, 和其 parameters.
Why Password Hashing Differs
Password hashing must be deliberately slow and memory-hard to resist GPU/ASIC brute force. Unlike fast cryptographic hashes, password hashes use tunable cost parameters (time, memory, parallelism). The salt prevents rainbow table and precomputation attacks across databases. Pepper adds a server-side secret to protect against database-only compromise. The cost must be periodically increased as hardware improves.
- slow
- Tunable iterations
- memory-hard
- Large memory requirement
- salt/pepper
- Per-user salt, server pepper
resist brute forcedefeats GPU/ASICprevents precomputationScheme Comparison
bcrypt is battle-tested with a 72-byte password limit and adjustable cost factor. scrypt requires both time and memory, making it harder to parallelize on GPUs. Argon2 (PHC winner) offers three variants: Argon2d (memory-hard), Argon2i (side-channel resistant), Argon2id (hybrid, recommended). PBKDF2 is FIPS-standardized but not memory-hard, making it weaker against GPU attacks. Argon2id is the modern default.
- bcrypt
- Battle-tested, 72-byte limit
- scrypt
- Memory + time hard
- Argon2id
- PHC winner, recommended
cost factorN, r, p paramst, m, p params