4 ms·
Ah ok... that is an interesting attack. Is the actual pin on the chip though? I would have assumed only a hash of it was stored, enough that it can verify the
by topranks 8y ago
Ah ok... that is an interesting attack.
Is the actual pin on the chip though? I would have assumed only a hash of it was stored, enough that it can verify the right pin has been supplied without having to store the actual code?
- baybal2 8y agoI there are full rainbow tables available for each used hash algo for 4 digit pins. They are routinely bruteforceable.
- tialaramex 8y agoWhereas I don't have criminal contacts who'd know whether anybody actually is stealing chip cards and de-capping them, I do know plenty about algorithms and data structures. Rainbow tables make no sense here, the rainbow table is a clever optimisation of the normal time-space tradeoff where we don't want to pay the full space cost, and will accept a time penalty (and usually in practice an accuracy penalty) to avoid using so much space. For a four digit PIN there is no concern about space, storing and indexing 10 000 possible hashes is trivial, (whereas storing and indexing say three trillion password hashes is kind of a pain so that's why you have rainbow tables)
- baybal2 8y agoWell, they are trivial, actually I ha e no idea of details