Products Openwall GNU/*/Linux   server OS Linux Kernel Runtime Guard John the Ripper   password cracker Free & Open Source for any platform in the cloud Pro for Linux Pro for macOS Wordlists   for password cracking passwdqc   policy enforcement Free & Open Source for Unix Pro for Windows (Active Directory) yescrypt   KDF & password hashing yespower   Proof-of-Work (PoW) crypt_blowfish   password hashing phpass   ditto in PHP tcb   better password shadowing Pluggable Authentication Modules scanlogd   port scan detector popa3d   tiny POP3 daemon blists   web interface to mailing lists msulogin   single user mode login php_mt_seed   mt_rand() cracker Services Publications Articles Presentations Resources Mailing lists Community wiki Source code repositories (GitHub) Source code repositories (CVSweb) File archive & mirrors How to verify digital signatures OVE IDs What's new

Password security: past, present, future

These are the slides we used at PHDays 2012. We've since used a newer revision of the slides at Passwords^12 in December 2012, so please check that revision out. This page is preserved primarily for historical reasons.

In a sense, this presentation is continued with Password hashing at scale (YaC 2012), New developments in password hashing: ROM-port-hard functions (ZeroNights 2012), and yescrypt - password hashing scalable beyond bcrypt and scrypt (PHDays 2014), so please check those out as well.

Please click on the slides for higher-resolution versions. You can also download a PDF file with all of the slides (5 MB).

128452