• Xanvial@lemmy.one
    link
    fedilink
    English
    arrow-up
    5
    ·
    edit-2
    1 year ago

    Some password hashing methods has max characters length. For example Bcrypt has 72 max length. This is mostly to avoid taking too much time encrypting user input.

    If there’s no limit someone can technically froze the server by inputting large password (not because the request is big, but the process is exponentially takes more CPU process the longer characters it needs to compute)

    • dudeami0@lemmy.dudeami.win
      link
      fedilink
      English
      arrow-up
      2
      ·
      1 year ago

      Having only ever implemented PBKDF2 this is a good insight as well. This limitation does not seem to be an issue with more modern hashing algorithms, but I can see where limiting the size to a reasonable amount for purposes of having an upper bound on performance would be needed.