Random algorithm selection

[jjl]

If you don't explicitly select an algorithm, encrypt chooses one seemingly at random.

Could you explain your rationale for that?

Making sure that my functions that wrap your functions return something resembling a crypted password are trivial for a known algo with a regex, but this breaks that and makes tests unrepeatable in the case that you forgot to supply an explicit algorithm.

[niwinz]

This approach enables that your passwords database will populated with passwords hashed using different, randomly choiced algorithm. If one of the hashers algorithms become vulnerable the affected passwords are much less using this technique.

If you prefer use one unique algorithm, just select it explicitly.

[jjl]

What you see as not putting all your eggs in one basket, I see as potentially injecting a weak algorithm into my database because I forgot to pass a parameter.

User interface matters in cryptography, see for example djb writing nacl to stop people getting crypto wrong.

[niwinz]

This is why the random is just a selection between documented and labeled as recommended algorithms with current recommended configuration.

I'm not getting crypto wrong because I'm not inventing new crypto schemes and new crypto algorithms. I'm just using a combination (one at time) of list of good crypto primitives.

In any case, and in this case, I thing you are right about this. It is not very intuitive, so I'm surely will revert that change on the next version.

[niwinz]

buddy-hashers 0.11.0 released with that change reverted among other changes.

Thanks.