Jonathan Schleifer
9c17ea513a
hex is only printed in verbose mode. This also includes some API redesign to pass the sg_parms struct directly instead of extracting each field of it and passing it manually. |
||
|---|---|---|
| config.aux | ||
| lib | ||
| test | ||
| .gitignore | ||
| config.h.in | ||
| configure | ||
| FORMAT | ||
| main.c | ||
| Makefile.in | ||
| README.md | ||
| scrypt.1 | ||
| scrypt_platform.h | ||
There are a number of password generators such as SuperGenPass,
PwdHash, etc. that generate a site-specific password from a master
password and the site's URL. An attacker who obtains your site-specific
password and the site's URL could attempt to determine your
master password by brute-force. Typically, these password generators
work by combining your master password with the site's URL and
computing a cryptographic (SHA1 or MD5) hash (perhaps using HMAC).
These hashes were designed such that they could be calculated very
quickly, which the opposite of what we want. A more secure method
would be to use PBKDF2 or bcrypt or Colin Percival's new scrypt
algorithm, which would make a brute-force attack many orders of
magnitude more difficult.
This project uses Colin Percival's scrypt as a password generator.
For documentation on how to use it, see
https://github.com/chrisoei/scrypt-genpass/wiki
For more details of how scrypt works, see