Intermediate LevelNode JS
Why should you use scrypt or Argon2 over pbkdf2 for enterprise password hashing in Node.js?
❓ Interview Prompt: pbkdf2 is CPU-hard but requires minimal RAM, making it vulnerable to GPU ASIC cracking rigs. scrypt (crypto.scrypt) and Argon2 are memory-hard algorithms, requiring massive RAM per guess to defeat hardware brute-forcing.
Password hashing requires compute-hard and memory-hard algorithms:
•
'pbkdf2': CPU-hard but requires negligible memory. Attackers use dedicated GPUs/ASICs to compute millions of hashes per second!
•
'scrypt' ('crypto.scrypt') / Argon2: Memory-Hard algorithms that require significant RAM per guess, rendering GPU/ASIC hardware brute-force attacks infeasible.
Code Implementation Example
javascript
import crypto from 'node:crypto';
import { promisify } from 'node:util';
const scrypt = promisify(crypto.scrypt);
async function hashPassword(password) {
const salt = crypto.randomBytes(16).toString('hex');
const derivedKey = await scrypt(password, salt, 64);
return '${salt}:${derivedKey.toString('hex')}';
}💡Hashing passwords securely using node:crypto scrypt.
🎯 Interview Key Takeaway
Use memory-hard algorithms like scrypt (crypto.scrypt) or Argon2 for password hashing to defeat GPU brute-forcing.
#scrypt#Argon2#Password Hashing#crypto#Intermediate
Back to all Node JS Questions→