199 private links
Instead of hash functions to store password, use Password-Based Key Derivation Functions (PBKDF) such as Argon2id.
bcrypt should be avoided due to its huge footgun: it truncates inputs longer than 72 characters. Okta AD/LDAP was vulnerable because of it.
Checksum functions such as CRC32 and xxh3 are optimized for pure speed and don't provide any security guarantees about their output, and it's easy to find collisions for a given checksum.
In 2024 based on I/O speed, a hash function with a throughput of 1 GB / s / core is considered fast enough for most use cases.
I skip the speed part because it is not relevant for me: 100MB/s or 1GB/s does not make much difference.
SHA3 and the BLAKE family which produced secures hash functions that are also misuse resistant.
A strength >= 128 bits is considered secure. The security agencies recommendation are a bit different. Hash length ranges from 256 (NIST) to 512 (ECRYPT-CSA).
SHA3 has many functions, SHA2 is vulnerable to length extension attacks (secret || message) but BLAKE3 has none of these issues.
Post-Quantum security from Grover's algorithm divides by 2 the preimage and 2nd-preimage resistance. The BHT algorithm predicts however that a quantum computer can find a collision in operations instead of 2^n/2
So SHA2 for convenience or BLAKE for the rest. There is only C and Rust that have official support for BLAKE though.
