-
Book Overview & Buying
-
Table Of Contents
Demystifying Cryptography with OpenSSL 3.0
By :
OpenSSL 3.0 supports several key derivation functions, but only two of them are suitable for deriving keys from passwords, namely, scrypt and PBKDF2.
PBKDF2 is a popular PBKDF, described and recommended by the PKCS #5 standard. It uses an HMAC function, such as HMAC-SHA-256, as an underlying PRF. PBKDF2 supports a tunable number of iterations and can be made computationally intensive, but not memory-intensive. In 2021, the Open Web Application Security Project (OWASP) recommended 310,000 iterations for PBKDF2 with the HMAC-SHA-256 PRF.
Scrypt is the best available choice for PBKDF in OpenSSL 3.0. Scrypt is a PBKDF that is not only computationally intensive but also memory-intensive. Scrypt uses PBKDF2 with HMAC-SHA-256 under the hood. Scrypt enables you to tune the volume of computations, memory usage, and parallelism. In 2021, OWASP recommended the following brute-force-resistant parameters for Scrypt: N=65,536, r=8,...