Re: [kitten] Comments on draft-ietf-kitten-password-storage-03

Sam Whited <sam@samwhited.com> Fri, 12 March 2021 19:12 UTC

User-Agent: Cyrus-JMAP/3.5.0-alpha0-206-g078a48fda5-fm-20210226.001-g078a48fd
Mime-Version: 1.0
Message-Id: <6762c057-ae0a-42f0-866e-0f107e648617@www.fastmail.com>
In-Reply-To: <1689536526.89782.1615481869806@email.ionos.com>
References: <1689536526.89782.1615481869806@email.ionos.com>
Date: Fri, 12 Mar 2021 14:11:38 -0500
From: Sam Whited <sam@samwhited.com>
To: KITTEN Working Group <kitten@ietf.org>
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable
Archived-At: <https://mailarchive.ietf.org/arch/msg/kitten/d30C35fdrS8h845dyDKRquQgpwI>
Subject: Re: [kitten] Comments on draft-ietf-kitten-password-storage-03
Precedence: list

Sorry, I think you brought this up before and I must have left it out of
the changes. I've made these changes and will fix it the next time I
upload a revision.

—Sam

On Thu, Mar 11, 2021, at 11:57, steve@tobtu.com wrote:
> For the output lengths, pick a number between 16 and 32 bytes
> and stick with that. I'd suggest 16, 24, or 32 but it doesn't
> really matter.
>
> ** Argon2 and scrypt ** Just say "[pick a number] Bytes or default"
> with [pick a number] being what ever you picked.
>
> ** bcrypt ** bcrypt is not a KDF. So you can't pick an output length.
> Thus "Output length: x (internal hash function output length)" should
> be removed as it does not make sense.
>
> ** PBKDF2 ** PBKDF2 should never output more than "hLen (length of the
> chosen hash)" for password hashing. So this should be "Which ever is
> smaller [pick a number] Bytes or hLen (length of the chosen hash)"
> with [pick a number] being what ever you picked.
>
> _______________________________________________
> Kitten mailing list Kitten@ietf.org
> https://www.ietf.org/mailman/listinfo/kitten
>

-- 
Sam Whited

[kitten] Comments on draft-ietf-kitten-password-s… steve
Re: [kitten] Comments on draft-ietf-kitten-passwo… Sam Whited