Skip to main content
Information Security

You are not logged in. Your edit will be placed in a queue until it is peer reviewed.

We welcome edits that make the post easier to understand and more valuable for readers. Because community members review edits, please try to make the post substantially better than how you found it, for example, by fixing grammar or adding additional resources and hyperlinks.

Required fields*

6
  • i need it to be fast as the overhead of an api key should be minimal Commented May 10, 2019 at 17:35
  • I see. Actually, I just updated my answer. Since your input is 128 bit keys rather than passwords the threat of offline cracking is not as likely. You're hashing it server side tho? Commented May 10, 2019 at 17:37
  • 2
    Small pedantic correction: PBKDF2 is doing multiple rounds of a hashing algorithm like SHA256... bcrypt is similar, but it uses the blowfish cypher, rather than hashing algorithms. (Such details only matter if you're trying to pick which key stretching algorithm to use, though, and in OP's case, doesn't matter at all since they don't need to stretch their keys to resist offline cracking.) Commented May 10, 2019 at 19:39
  • 3
    Everything between the first paragraph and the last two sentences is somewhere between misleading and just bad advice. For a securely-generated 128-bit random key, you should not use multiple rounds of hashing or anything like bcrypt; the entropy of the input is so high that brute-forcing it is already impossible (practically speaking). Adding cost is pure negative. In fact, from a security perspective, SHA1 would probably be OK if it weren't for the fact that it'll cause any competent static analysis tool to yell at you. Commented May 10, 2019 at 20:31
  • You don't need a KDF if the key is a "generated key" and not a password... @CBHacking is correct. Commented May 11, 2019 at 1:51