3 ms·

Sorry, I still don't understand. Does this assume that all passwords share the same salt, so, not a nonce? Because if each hash has a nonce, I didn't know there

Sorry, I still don't understand. Does this assume that all passwords share the same salt, so, not a nonce? Because if each hash has a nonce, I didn't know there was a fast way to brute force a database of those. (Assuming that the developer isn't using md5, of course, but even then I wouldn't expect it to yield a lot of results very quickly.)

tptacek 17y ago
Sigh. 1. Take a hash. 2. Start at "aardvark". 3. SHA1 the salt + aadvark. 4. Compare to the hash. 5. Repeat until "zymoscope". It's so weird to me that rainbow tables have so captured people's imaginations that they can't comprehend other attacks to hashes, despite the fact that the brute-force attack I just described was the only way password files were ever cracked for the entirety of the 1990s. It's plenty fast.
- thaumaturgy 17y ago
  That attitude was uncalled-for. I'm aware of how brute force attacks work, thank you; and when you say "it's plenty fast", I'd guess you're referring to the difference between "slow" hashes -- like bcrypt -- or "fast" ones, like MD5. ...Which has nothing to do with whether salts are a good idea or not, which was actually my question. Furthermore, your example there assumes a dictionary to throw at the hashes, which is stupid, because if the website (or other application) doesn't have a sane password policy in the first place, then you don't even need their database of hashes. So, the whole "rainbow table" example you just sighed about was completely irrelevant to my question. Maybe I can put this another way that'll make more sense. Let's say I have a 150,000 computer botnet -- pretty small by today's standards, and not that hard to achieve really. And let's also say that I have a database of 10 million accounts that I snatched from some business, and better yet, let's say that they don't know about it, because I was uncommonly smart and I didn't brag that I got it. Now, I want to retrieve the passwords for as many of those 10 million accounts as possible, using my botnet. Further, let's say that the company was uncommonly smart, and they twofish'd all of their passwords with enough stretching to piss me off. How much more pissed-off will I be when I discover that they've concatenated a 128-bit randomly generated nonce to each password? Because my guess is, a lot more pissed off, since I can no longer distribute my dictionary of 500,000 commonly found passwords to the botnet, run it through their pessimal twofish, and then look for collisions.
  - tptacek 17y ago
    I'm confused but happy, because your "pessimized Twofish" is basically bcrypt, which is inherently "salted".

tptacek 17y ago

Sigh. 1. Take a hash. 2. Start at "aardvark". 3. SHA1 the salt + aadvark. 4. Compare to the hash. 5. Repeat until "zymoscope". It's so weird to me that rainbow tables have so captured people's imaginations that they can't comprehend other attacks to hashes, despite the fact that the brute-force attack I just described was the only way password files were ever cracked for the entirety of the 1990s. It's plenty fast.

thaumaturgy 17y ago
That attitude was uncalled-for. I'm aware of how brute force attacks work, thank you; and when you say "it's plenty fast", I'd guess you're referring to the difference between "slow" hashes -- like bcrypt -- or "fast" ones, like MD5. ...Which has nothing to do with whether salts are a good idea or not, which was actually my question. Furthermore, your example there assumes a dictionary to throw at the hashes, which is stupid, because if the website (or other application) doesn't have a sane password policy in the first place, then you don't even need their database of hashes. So, the whole "rainbow table" example you just sighed about was completely irrelevant to my question. Maybe I can put this another way that'll make more sense. Let's say I have a 150,000 computer botnet -- pretty small by today's standards, and not that hard to achieve really. And let's also say that I have a database of 10 million accounts that I snatched from some business, and better yet, let's say that they don't know about it, because I was uncommonly smart and I didn't brag that I got it. Now, I want to retrieve the passwords for as many of those 10 million accounts as possible, using my botnet. Further, let's say that the company was uncommonly smart, and they twofish'd all of their passwords with enough stretching to piss me off. How much more pissed-off will I be when I discover that they've concatenated a 128-bit randomly generated nonce to each password? Because my guess is, a lot more pissed off, since I can no longer distribute my dictionary of 500,000 commonly found passwords to the botnet, run it through their pessimal twofish, and then look for collisions.
- tptacek 17y ago
  I'm confused but happy, because your "pessimized Twofish" is basically bcrypt, which is inherently "salted".