Wouldn't it be wise to wait for argon2 to get some more cryptanalysis and testing in the field before jumping on it, sticking to scrypt or bcrypt in the meantime?
No. The reason not to use Argon2 is that it doesn't have great library support yet. Password hashes don't really fail like ciphers do. Nothing that is discovered in Argon2 is going to make it worse than PBKDF2, and using PBKDF2 is just fine if that's all you've got.
>> and using PBKDF2 is just fine if that's all you've got.
Yeah, people spend way too much time wondering if they should use scrypt, bcrypt, PBKDF2, etc. There are legitimate differences, but unless you know those ahead of time it's almost certainly better to just choose one instead of waffling around.
It might happen if you designed a password hash from first principles, but that is not how Argon2 was designed, or, really, any of the Password Hashing Contest finalists. They're built on top of existing crypto primitives.
4096 bit keys are useless if your root or intermediate is 2048 bit. How many CAs even offer 4096 roots and intermediates? Do CAs even bother to ask, or do they give you 2048 anyway, because FU?
Comments
Quibbles:
* You're right now fine with 2048 bit keys. The thing that jeopardizes 2048 bit keys might end up knocking RSA out entirely.
* There's really no point to fail2ban if you disabled passwords for SSH, and doing that is much more important than fail2ban.
* The checklist item for password security should make it clear that you need a password hash (PBKDF2, bcrypt scrypt, Argon2), not just a "hash".
Given the context, the only big thing that's missing is HPKP.
Wouldn't it be wise to wait for argon2 to get some more cryptanalysis and testing in the field before jumping on it, sticking to scrypt or bcrypt in the meantime?
No. The reason not to use Argon2 is that it doesn't have great library support yet. Password hashes don't really fail like ciphers do. Nothing that is discovered in Argon2 is going to make it worse than PBKDF2, and using PBKDF2 is just fine if that's all you've got.
>> and using PBKDF2 is just fine if that's all you've got.
Yeah, people spend way too much time wondering if they should use scrypt, bcrypt, PBKDF2, etc. There are legitimate differences, but unless you know those ahead of time it's almost certainly better to just choose one instead of waffling around.
The reference library we do have looks set to make further breaking changes[0], which complicates this further.
[0] https://github.com/P-H-C/phc-winner-argon2/pull/119/files
Huh?
A password hash could happen to be reversible, or could map lots of passwords to the same value.
No, neither of those things are going to happen.
It might happen if you designed a password hash from first principles, but that is not how Argon2 was designed, or, really, any of the Password Hashing Contest finalists. They're built on top of existing crypto primitives.
4096 bit keys are useless if your root or intermediate is 2048 bit. How many CAs even offer 4096 roots and intermediates? Do CAs even bother to ask, or do they give you 2048 anyway, because FU?
Agree on fail2ban w.r.t ssh, though it can still be useful in other scenarios e.g. blocking brute-force attacks on a website login page, or on an API.