search

randombit / botan

Cryptography Toolkit
https://botan.randombit.net
BSD 2-Clause "Simplified" License
2.47k stars 552 forks source link

Request to add: Catena, Lyra2, Makwa, yescrypt #3965

Open wendig0x opened 3 months ago

wendig0x commented 3 months ago

The Password Hashing Competition had some worthy participants: Catena, Lyra2, Makwa and yescrypt. Maybe they should be added to Botan?

randombit commented 3 months ago

The primary criteria for adding an algorithm (beyond someone actually writing the code) is if that algorithm is or will be in use in some real world system or protocol.

The secondary criteria is if the algorithm has some notable benefit compared to other systems such that it's worth including because it should be used in real world systems, even if not currently.

As far as I know none of these hashes qualifies under the first criteria. (Please correct me if I'm wrong about this, this is just based on what I've seen used in the past.) On the second crtieria I don't know enough about these other hashes to have an opinion. Certainly I find both Argon2 and scrypt quite poorly designed so I'm open to the possibility. But it would have to come in an argument of "Attribute X is something that makes algo Z superior to {Argon2,scrypt,bcrypt} in some specific scenario and this attribute is so nice it's worth including not just yet another password hash, but one that's not widely used/known/studied."

wendig0x commented 2 months ago

This is where the contestants are discussed: https://crypto.stackexchange.com/questions/48933/why-did-argon2-win-the-phc From the looks of it, the best candidate for realization is Catena.

The reason for adding the hash - I believe there should be some choice, not just the "officially endorsed" candidate (Argon2)