Erlang PBKDF2 library

[Bryan Frimin]

Hello everyone,

I've published a pure Erlang implementation of the PBKDF2 algorithms[1].
I hope the library will be as useful for you as it was helpful for me.

Regards,

[1] https://github.com/exograd/erl-pkcs5

--
Bryan Frimin
https://www.frimin.fr
[hidden email]

[Сергей Прохоров-2]

Hi, Bryan,

Is there some difference from this implementation?

https://github.com/basho/erlang-pbkdf2

We have a ticket in `epgsql` to replace our "homemade" implementation of this algorithm https://github.com/epgsql/epgsql/issues/172, but never actually had time to look into it.

Regards,

Sergey

[Bryan Frimin]

Hello Sergey,

> Is there some difference from this implementation?
> https://github.com/basho/erlang-pbkdf2
The two libraries are very similar. The main differences are:
- Released under ISC license;
- Uses the new Erlang crypto API;
- Strictly follows the RFC implementation instead of being compliant
  with the Apache CouchDB.

> We have a ticket in `epgsql` to replace our "homemade" implementation of
> this algorithm https://github.com/epgsql/epgsql/issues/172, but never
> actually had time to look into it.
Not sure I understand the motivation you can have to use external
dependency instead of your implementation.

Regards,

--
Bryan Frimin
https://www.frimin.fr
[hidden email]

[Сергей Прохоров-2]

ср, 10 февр. 2021 г. в 15:17, Bryan Frimin <[hidden email]>:

Hello Sergey,

> Is there some difference from this implementation?
> https://github.com/basho/erlang-pbkdf2
The two libraries are very similar. The main differences are:
- Released under ISC license;
- Uses the new Erlang crypto API;
- Strictly follows the RFC implementation instead of being compliant
  with the Apache CouchDB.

Ah, nice! Thanks!

 

> We have a ticket in `epgsql` to replace our "homemade" implementation of
> this algorithm https://github.com/epgsql/epgsql/issues/172, but never
> actually had time to look into it.
Not sure I understand the motivation you can have to use external
dependency instead of your implementation.

I guess, mainly the rule of thumb "try to not implement your own crypto, when there are already available well-tested libraries for that".

Also, as the ticket says, Elixir's postgres driver uses an external library for pbkdf2 as well, doubling this opinion.

 

Regards,

--
Bryan Frimin
https://www.frimin.fr
[hidden email]

[Bryan Frimin]

Hello Paulo,

> Was using basho's erlang-pbkdf2, but will give this a look. Have you
> considered publishing it to Hex.pm?

Because hex.pm does not have support for namespaces, it is impossible to
publish this library to hex.pm as the package name is already taken by
an Elixir library that does nothing.

Regards,

--
Bryan Frimin
https://www.frimin.fr
[hidden email]

[Bryan Frimin]

Łukasz Niemier <[hidden email]> writes:

>> Because hex.pm does not have support for namespaces, it is impossible to
>> publish this library to hex.pm as the package name is already taken by
>> an Elixir library that does nothing.
>
> You can send message to Hex team as name squatting is against EULA IIRC.
>

You right; I can open a dispute to get the ownership of the package
name. But it's time consuming (at least 30 days) and as I don't use
hex.pm I don't want to lose time on this.

Regards,

--
Bryan Frimin
https://www.frimin.fr
[hidden email]