4 ms·
> (I think your math on bits is wrong: I'm getting that log2(1010 * 23 * 365 * 4) = 33.4, not 28.) 1. Totally right that I'm wrong, but I'm now getting 48 bits
by kilburn 9y ago
> (I think your math on bits is wrong: I'm getting that log2(1010 * 23 * 365 * 4) = 33.4, not 28.)
1. Totally right that I'm wrong, but I'm now getting 48 bits, not 33 ;)
2. That was a terrible mistake of my own. The lookup key is derived from the password, not the other way around. I've corrected the article to clarify that!
3. Yeah that's why I said you can do it with your laptop and not too much time ;)
Only using the latest part of the DNI is not that good though. The letter is actually a control character, which can be computed from the 8 numbers. Hence, if you have 5 numbers and the letter, there are only some possible 3-digit prefixes that lead to a valid DNI! How many? I would have to investigate further hehe...
- rrobukef 9y agoI can't check, but isn't sha256_times(passkey, 1713) == passkey? (sha256_times(sha256(a), 1713) == sha256_times(a,1714)?) The encryption is then basically worthless if you have a list of all lookups. (I didn't see a dynamic in the sha256_times function.)