3 ms·

Passive observation of execution times can predict password length (smaller concern). Seems like this can radically narrow the focus of a dictionary attack. Al

Passive observation of execution times can predict password length (smaller concern). Seems like this can radically narrow the focus of a dictionary attack. Also, if you are just trying to get a foothold into a machine, you can focus your energy on short passwords. Of course, I am not sure of all the scenarios where you are privy to how long the encryption took.

eganist 8y ago
Putting the codeboxed quote down as a regular quote for mobile legibility. > Passive observation of execution times can predict password length (smaller concern).
tialaramex 8y ago
> Seems like this can radically narrow the focus of a dictionary attack It does until you look at the charts, or read the text more carefully. The charts look impressive because they're showing ranges up to hundreds or even thousands of bytes. But look closer and they're very noisy when it comes to narrow ranges. It really is easy to distinguish "The bells, they grow ever closer and I fear this night will be our last fair Susanne, but we must hold fast against the light and promise ourselves that we'll fight on, until the last drop" from "123456". But "password1" versus "ckjones4ever" not so much, which means it's not very practical for any actual bad guys.
jnwatson 8y ago
This doesn't leak anything about the length of the correct password. This leaks information about the length of the guess, which the attacker already knows.
atoponce 8y ago
> Seems like this can radically narrow the focus of a dictionary attack. It's leaking information, and we don't like this, but it's not fatal. 96% will have passwords less than 16 characters (see https://blog.cynosureprime.com/2017/08/320-million-hashes-exposed.html https://blog.cynosureprime.com/2017/08/320-million-hashes-ex...). This is within the first "step" in the sha512crypt hashing process, and longer passwords may have enough entropy, so learning their length is not providing any practical advantage in cracking the password, should the database be compromised. The larger concern is CPU load. There are load jumps between 1-15, and 16-23 characters, and 24-80, etc. Even though 96% of users will fall in the 1-16 range, if you put a minimum length requirement of perhaps 12 characters, you may see that you need to decrease your sha512crypt cost to handle your tested load, because more of your users are passing 16 characters in length (yay) than normal (although most will like do exactly 12 characters). Does that make sense?

eganist 8y ago

Putting the codeboxed quote down as a regular quote for mobile legibility. > Passive observation of execution times can predict password length (smaller concern).

tialaramex 8y ago

> Seems like this can radically narrow the focus of a dictionary attack It does until you look at the charts, or read the text more carefully. The charts look impressive because they're showing ranges up to hundreds or even thousands of bytes. But look closer and they're very noisy when it comes to narrow ranges. It really is easy to distinguish "The bells, they grow ever closer and I fear this night will be our last fair Susanne, but we must hold fast against the light and promise ourselves that we'll fight on, until the last drop" from "123456". But "password1" versus "ckjones4ever" not so much, which means it's not very practical for any actual bad guys.

jnwatson 8y ago

This doesn't leak anything about the length of the correct password. This leaks information about the length of the guess, which the attacker already knows.

atoponce 8y ago

> Seems like this can radically narrow the focus of a dictionary attack. It's leaking information, and we don't like this, but it's not fatal. 96% will have passwords less than 16 characters (see https://blog.cynosureprime.com/2017/08/320-million-hashes-exposed.html https://blog.cynosureprime.com/2017/08/320-million-hashes-ex...). This is within the first "step" in the sha512crypt hashing process, and longer passwords may have enough entropy, so learning their length is not providing any practical advantage in cracking the password, should the database be compromised. The larger concern is CPU load. There are load jumps between 1-15, and 16-23 characters, and 24-80, etc. Even though 96% of users will fall in the 1-16 range, if you put a minimum length requirement of perhaps 12 characters, you may see that you need to decrease your sha512crypt cost to handle your tested load, because more of your users are passing 16 characters in length (yay) than normal (although most will like do exactly 12 characters). Does that make sense?