Erlang PBKDF2 library

classic Classic list List threaded Threaded
6 messages Options
Reply | Threaded
Open this post in threaded view
|

Erlang PBKDF2 library

Bryan Frimin
Hello everyone,

I've published a pure Erlang implementation of the PBKDF2 algorithms[1].
I hope the library will be as useful for you as it was helpful for me.

Regards,

[1] https://github.com/exograd/erl-pkcs5

--
Bryan Frimin
https://www.frimin.fr
[hidden email]

Reply | Threaded
Open this post in threaded view
|

RE: Erlang PBKDF2 library

Сергей Прохоров-2
Hi, Bryan,

Is there some difference from this implementation?

We have a ticket in `epgsql` to replace our "homemade" implementation of this algorithm https://github.com/epgsql/epgsql/issues/172, but never actually had time to look into it.

Regards,
Sergey
Reply | Threaded
Open this post in threaded view
|

Re: Erlang PBKDF2 library

Bryan Frimin
Hello Sergey,

> Is there some difference from this implementation?
> https://github.com/basho/erlang-pbkdf2
The two libraries are very similar. The main differences are:
- Released under ISC license;
- Uses the new Erlang crypto API;
- Strictly follows the RFC implementation instead of being compliant
  with the Apache CouchDB.

> We have a ticket in `epgsql` to replace our "homemade" implementation of
> this algorithm https://github.com/epgsql/epgsql/issues/172, but never
> actually had time to look into it.
Not sure I understand the motivation you can have to use external
dependency instead of your implementation.

Regards,

--
Bryan Frimin
https://www.frimin.fr
[hidden email]
Reply | Threaded
Open this post in threaded view
|

Re: Erlang PBKDF2 library

Сергей Прохоров-2


ср, 10 февр. 2021 г. в 15:17, Bryan Frimin <[hidden email]>:
Hello Sergey,

> Is there some difference from this implementation?
> https://github.com/basho/erlang-pbkdf2
The two libraries are very similar. The main differences are:
- Released under ISC license;
- Uses the new Erlang crypto API;
- Strictly follows the RFC implementation instead of being compliant
  with the Apache CouchDB.

Ah, nice! Thanks!
 
> We have a ticket in `epgsql` to replace our "homemade" implementation of
> this algorithm https://github.com/epgsql/epgsql/issues/172, but never
> actually had time to look into it.
Not sure I understand the motivation you can have to use external
dependency instead of your implementation.


I guess, mainly the rule of thumb "try to not implement your own crypto, when there are already available well-tested libraries for that".
Also, as the ticket says, Elixir's postgres driver uses an external library for pbkdf2 as well, doubling this opinion.
 
Regards,

--
Bryan Frimin
https://www.frimin.fr
[hidden email]
Reply | Threaded
Open this post in threaded view
|

Re: Erlang PBKDF2 library

Bryan Frimin
In reply to this post by Bryan Frimin
Hello Paulo,

> Was using basho's erlang-pbkdf2, but will give this a look. Have you
> considered publishing it to Hex.pm?

Because hex.pm does not have support for namespaces, it is impossible to
publish this library to hex.pm as the package name is already taken by
an Elixir library that does nothing.

Regards,

--
Bryan Frimin
https://www.frimin.fr
[hidden email]
Reply | Threaded
Open this post in threaded view
|

Re: Erlang PBKDF2 library

Bryan Frimin
Łukasz Niemier <[hidden email]> writes:

>> Because hex.pm does not have support for namespaces, it is impossible to
>> publish this library to hex.pm as the package name is already taken by
>> an Elixir library that does nothing.
>
> You can send message to Hex team as name squatting is against EULA IIRC.
>

You right; I can open a dispute to get the ownership of the package
name. But it's time consuming (at least 30 days) and as I don't use
hex.pm I don't want to lose time on this.

Regards,

--
Bryan Frimin
https://www.frimin.fr
[hidden email]