[Caml-list] [ANN] ocaml-safepass 1.0

[Caml-list] [ANN] ocaml-safepass 1.0

[Dario Teixeira]

Hallo,

The registration of users with login + password is a common feature in 
web sites.  And as you know, this login data is a valuable prize for
attackers.  Therefore I'm happy to announce the availability of version
1.0 of OCaml-safepass, a simple library offering facilities for the safe
storage of user passwords.  By "safe" I mean that passwords are salted
and hashed using the Bcrypt algorithm [1].  Salting prevents rainbow-table
based attacks [2], whereas hashing by a very time-consuming algorithm such
as Bcrypt renders brute-force password cracking impractical.

OCaml-safepass's obvious usage domain are web applications, though it
does not depend on any particular framework.  Internally, OCaml-safepass
binds to the C routines from Openwall's Crypt_blowfish [3].  However,
it would be incorrect to describe OCaml-safepass as an OCaml binding
to Crypt_blowfish, because the API it exposes is higher-level and more
compact than that offered by Crypt_blowfish.  Moreover, OCaml-safepass's
API takes advantage of OCaml's type-system to make usage mistakes nearly
impossible.

Here is the project website:
http://ocaml-safepass.forge.ocamlcore.org/

The API documentation is also available on online:
http://ocaml-safepass.forge.ocamlcore.org/apidoc/index.html

Feedback is more than welcome!
Best regards,
Dario Teixeira

[1] http://en.wikipedia.org/wiki/Bcrypt
[2] http://en.wikipedia.org/wiki/Rainbow_table
[3] http://www.openwall.com/crypt/