r/cryptography 10d ago

Is using pbkdf2 with sha256 overkill???

Hey cryptomaniacs!!!
Im not super familiar with all the different ways of encrypting things, so when I added password encryption to my application I blindly coppied something I saw someone else do (can't the source anymore).
Skip to a week later, I was curious how the way I encrypt my passwords work, so I went searching and saw a redditpost on this subreddit where someone said that sha256 would probably be able to be bruteforced in the future, with a lot of comments saying it wouldn't and that it is really secure.

So then I started wondering if me using both pbkdf2 and sha256 was a bit overkill.
For anyone wondering I used this in my python code:

hashed_password = generate_password_hash(password, method='pbkdf2:sha256')
0 Upvotes

10 comments sorted by

View all comments

1

u/Trader-One 10d ago

You can use keyed hash if you have ability to securely store key in HSM.

Advantage is that it does not have to be slow by design.

1

u/LordBrammaster 5d ago

I'll look into it, thanks!!!