noble-hashes
yescrypt
| noble-hashes | yescrypt | |
|---|---|---|
| 2 | 3 | |
| 470 | 114 | |
| - | 5.3% | |
| 8.5 | 3.4 | |
| about 1 month ago | 7 months ago | |
| JavaScript | C | |
| MIT License | - |
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
noble-hashes
yescrypt
-
Inception: Leaking the root hash from /etc./shadow on AMD Zen 4 [video]
when you look properly at the end of the video the root hash starts with $y$ implying its yescrypt
more info here https://manpages.debian.org/unstable/libcrypt-dev/crypt.5.en...
https://www.openwall.com/yescrypt/
once you have the hash you have to use some rainbow tables if they exist for that hash function or bruteforce it
the authors of yescrypt claim: "Technically, yescrypt is the most scalable password hashing scheme so far, providing near-optimal security from offline password cracking across the whole range from kilobytes to terabytes and beyond. "
in any way, this is a local attack, someone / some software on your local machine would need to execute it so i am not overly stressed, password hashes leak all the time from all different sources
yet, it does worry me because my AMD stock is dropping on value because of this today :D
-
ELI5: why is a password that uses numbers and letters stronger than one with only letters? the attackers don't know that you didn't use numbers, so they must include numbers in their brute force either way.
I believe SHA512 or yescrypt are the favored hashing algorithms.
-
PoS
Ya, yescrypt and also yespower which is a derivative for PoW, does it so we can just use that code or fork it. Also we would need a new idea to keep it CPU viable forever, and I discovered a way to do that, simply increase the required memory size (called memory hardness) with moore's law.
What are some alternatives?
crypto-js - JavaScript library of crypto standards.
john - John the Ripper jumbo - advanced offline password cracker, which supports hundreds of hash and cipher types, and runs on many operating systems, CPUs, GPUs, and even some FPGAs
DeadHash-js - DeadHash - JS version
hmac-bcrypt - The hmac-bcrypt password hashing function
argon2-browser - Argon2 library compiled for browser runtime
yespower - Proof-of-work scheme building upon yescrypt and scrypt
hash-library - Portable C++ hashing library
password4j - Java cryptographic library that supports Argon2, bcrypt, scrypt and PBKDF2 aimed to protect passwords in databases. Easy to use by design, highly customizable, secure and portable. All the implementations follow the standards and have been reviewed to perform better in the JVM.
JeChain - JeChain decentralized application platform and smart contract blockchain network
c-hash - LiamLoads is a fast and secure 256-bit hashing function in pure C.
nodejs-hashing - There is a class in the crypto module called Hash that we are going to use in the example.
forge - A native implementation of TLS in Javascript and tools to write crypto-based and network-heavy webapps