3 ms·

This wouldn't work without some really bizarre implementation that would make it less of a hash and more of a cipher. The range of potential values is too smal

by woodman 10y ago

This wouldn't work without some really bizarre implementation that would make it less of a hash and more of a cipher. The range of potential values is too small and highly structured, generating a rainbow table would be braindead simple. > ...tamperproof keystore that exploded... So not one way hashes then?

abraae 10y ago
Ha ha, excellent point until we have ipv6. Less late nights for me.
- kyledrake 10y ago
  That's a really interesting point actually. A hash of IPv6 would essentially be technically infeasible to brute force if fed through something like scrypt. But it wouldn't be exactly 128 bit random, since they could do a search based on the addresses allocated. I'd need to know the size of that potential pool to know how hard that would be, but if it's already in the dozens of billions, it's pretty difficult.
kyledrake 10y ago
Generating a salt and tossing it into scrypt would break any rainbow table attempts, but it's still only 4,294,967,296 or so addresses for v4. It's pretty hard for a small government to do it, but I wouldn't put it past the NSA. This is how we've implemented IP address retention at Neocities, BTW: https://github.com/neocities/neocities/commit/4983a9b24eac00b8d8bfd300a18cdcee0152a271 https://github.com/neocities/neocities/commit/4983a9b24eac00... Step two is to throw them away after x amount of time. It's not perfect, but there you go. The best way is still to throw them away from the beginning, but we do need them for spammers and the like.
- woodman 10y ago
  Subtract 588 million reserved IPs, as well as 2 from each subnet (0 and 255). There are also a lot of blocks that are publicly routable but see no use on the internet. If I were to build a rainbow table, I'd start with blocks assigned to ISPs, then throw in the results of publicly available distributed internet surveys, only then would I start the algorithmic address generation. Same story for IPv6. I really don't think it is a state actor level problem, but if it is it won't be for long.
  - kyledrake 10y ago
    Right, no I agree, except that the rainbow table won't work if you used a salt. You'll need to brute force it for that particular salt value. Still quite doable, if you have the right resources at hand. As you pointed out, it's less than the entire IPv4 space too.
dredmorbius 10y ago
Regularly changed salts? If the reason for holding IPs is to be able to, say, mitigate network abuse, then a salt or other addition which is only available for a brief period would prevent being able to test a long-term datastore for a given IP.

by woodman 10y ago

abraae 10y ago

Ha ha, excellent point until we have ipv6. Less late nights for me.

kyledrake 10y ago
That's a really interesting point actually. A hash of IPv6 would essentially be technically infeasible to brute force if fed through something like scrypt. But it wouldn't be exactly 128 bit random, since they could do a search based on the addresses allocated. I'd need to know the size of that potential pool to know how hard that would be, but if it's already in the dozens of billions, it's pretty difficult.

kyledrake 10y ago

Generating a salt and tossing it into scrypt would break any rainbow table attempts, but it's still only 4,294,967,296 or so addresses for v4. It's pretty hard for a small government to do it, but I wouldn't put it past the NSA. This is how we've implemented IP address retention at Neocities, BTW: https://github.com/neocities/neocities/commit/4983a9b24eac00b8d8bfd300a18cdcee0152a271 https://github.com/neocities/neocities/commit/4983a9b24eac00... Step two is to throw them away after x amount of time. It's not perfect, but there you go. The best way is still to throw them away from the beginning, but we do need them for spammers and the like.

woodman 10y ago
Subtract 588 million reserved IPs, as well as 2 from each subnet (0 and 255). There are also a lot of blocks that are publicly routable but see no use on the internet. If I were to build a rainbow table, I'd start with blocks assigned to ISPs, then throw in the results of publicly available distributed internet surveys, only then would I start the algorithmic address generation. Same story for IPv6. I really don't think it is a state actor level problem, but if it is it won't be for long.
- kyledrake 10y ago
  Right, no I agree, except that the rainbow table won't work if you used a salt. You'll need to brute force it for that particular salt value. Still quite doable, if you have the right resources at hand. As you pointed out, it's less than the entire IPv4 space too.

dredmorbius 10y ago

Regularly changed salts? If the reason for holding IPs is to be able to, say, mitigate network abuse, then a salt or other addition which is only available for a brief period would prevent being able to test a long-term datastore for a given IP.