4 ms·
Truncation to 8 characters is an entropy killer; limiting the range of characters by using the truncated strong hash as the input will reduce it further. In a w
by qjz 16y ago
Truncation to 8 characters is an entropy killer; limiting the range of characters by using the truncated strong hash as the input will reduce it further. In a weak system, you're more likely to find a collision that will effectively substitute for the original password. For two such systems to coexist, you'd need to enforce the use of passwords greater than 8 characters to prevent a crack on the weak system from working on the stronger one.
- JonnieCache 16y agoThankyou. This is very interesting. Whenever I study cryptography I feel a bit like Alice going down the rabbit hole. Thank god the safe best-practices are clear and simple in the majority of cases. EDIT: in case anyone reading this is wondering, the safe best-practice is to USE BCRYPT. http://codahale.com/how-to-safely-store-a-password/ http://codahale.com/how-to-safely-store-a-password/