On Wed, 30 May 2012, Maarten Billemont wrote: > I'm currently considering asking the user for their full name and > using that as a salt in the scrypt operation. [[...]]
Digressing slightly from crypto, note that "full name" is not as tidy or troublefree a concept as one might think. It's instructive to look through http://www.kalzumeus.com/2010/06/17/falsehoods-programmers-believe-about-names/ (read all the comments!) and think about how your user interface will try to work around issues #2,3,4,7,11,12,13,24,25,26,27, and 35. A particularly tricky point is how to handle characters which aren't on the standard virtual/physical keyboard (actually that's issue #11 in that list). Given that you want invariance under "discard/loose hardware, buy new hardware", you don't just need to canonicalize the name (which is already tricky in an i18n context), you need to do so in a hardware-independent way. What happens when the user upgrades from hardware/software which doesn't have native support for some of the letters in her name (e.g., she's German and her family name is "L o-umlaut f f l e r", but her smartphone is a US model which only groks [a-zA-Z] as letters) to new hardware/software which *does* grok the letters (e.g., she buys a new smartphone in Germany, which *does* have o-umlaut on its virtual|physical keyboard)? ciao, -- -- "Jonathan Thornburg [remove -animal to reply]" <jth...@astro.indiana-zebra.edu> Dept of Astronomy & IUCSS, Indiana University, Bloomington, Indiana, USA "Washing one's hands of the conflict between the powerful and the powerless means to side with the powerful, not to be neutral." -- quote by Freire / poster by Oxfam _______________________________________________ cryptography mailing list cryptography@randombit.net http://lists.randombit.net/mailman/listinfo/cryptography
