Comment

Comment by jmercan

Frankly, if you have to ask, just use a (system) CSPRNG.

People massively overblow the impact of the speed difference for most scenarios. Yes, A simulation running on a large scale etc. will probably need a statistically good RNG w/o any security properties but (say) a game generating a seed occasionally will not be bottlenecked by using a CSPRNG. I would say it is worth it just to not have any mental load and slightest change of misuse.

Also, if the salt part is for salting and hashing passwords, forget about the whole idea and use a proper password hash be it Argon2id, scrypt, PBKDF2, whatever. It doesn't really matter which one and ideally a library should have chosen one of the algorithms with good parameters and nonce generation.

(I know Argon2 calls its nonce a salt too but that is irrelevant. It should come from a CSPRNG)

parent jmercan 4 years ago

No comments yet

Be the first to share your thoughts.

Live from the official Hacker News API

A modern reader for Hacker News · SvelteKit + Skeleton