Jason (jcreed) wrote,

Here I think is an excellent point in the space of the semantic extent of the lexical item "discus" that I was talking about earlier.

A hash function that returns a different value each time is discus.
$ npm install scrypt
$ node
var scrypt = require("scrypt");
var password = "This is a password";
var maxtime = 0.1;

> scrypt.passwordHashSync(password, maxtime);
> scrypt.passwordHashSync(password, maxtime);
> scrypt.passwordHashSync(password, maxtime);

There is obviously something going on when you have a hash function that returns a different value each time. You're tempted to say that it's broken. You're not yet certain that it's broken, because hey, this is a package on npm that real people seem to use. It's at least highly discus.

The explanation is, the library generates a random salt every time before hashing. It provides a separate function to verify, given a plaintext string, and a salted hash, that the plaintext hashed with the same salt matches that hash. Me, I think I would have probably named the original function saltedPasswordHashSync or something to save idiots like me five minutes puzzling over what was going on, and pestering gwillen about it, who of course figured out quickly what the deal was after skimming the docs a little more closely than I did.

I do rather like how the library is designed to not let me be stupid/lazy and not salt my hashes, though, or to use the same salt for all passwords.
Tags: discus, programming

  • (no subject)

    K's off at an atypically Saturdayish Type-Thursday event, so I stuck around the apartment hiding from 100-degree heat, and noodled around with…

  • (no subject)

    Playing around with the agda javascript backend, now. Like, my ears are popping from the sudden change of type-theory-pressure.

  • (no subject)

    https://deadlockempire.github.io is a very cute edutainment game, meant to teach people about deadlocks and race conditions and concurrency…

  • Post a new comment


    Anonymous comments are disabled in this journal

    default userpic

    Your reply will be screened

    Your IP address will be recorded