5 ms·
His entire argument hinges on this one sentence: "Once the salt is known, it would be pretty trivial to dictionary a bunch of hashes in little or no time and ge
by dsl 15y ago
His entire argument hinges on this one sentence:
"Once the salt is known, it would be pretty trivial to dictionary a bunch of hashes in little or no time and get a pretty significant hit rate."
The author does not understand that salts primarily protect against rainbow tables (pre-computation attacks). He assumes the purpose is to increase brute force search complexity or somehow add additional secrecy, and is correct that it fails at both.
If you are already using user specific salts and a strong SHA hash, the next place you should be looking to add security is increasing the number of rounds (i.e. sha(sha(sha(hash+pass)))) or switching to bcrypt (which takes advantage of an expensive key setup phase in blowfish to make brute force searches very painful).
- getsat 15y agoRainbow tables don't really matter as much anymore when a consumer-grade GPU can calculate hundreds of millions of SHA/MD hashes per second. You're not really slowing an attacker down anymore. Whenever this topic comes up, this link should be posted: http://codahale.com/how-to-safely-store-a-password/ http://codahale.com/how-to-safely-store-a-password/
- dsl 15y agoRe-read the last sentence of my post. Also, rainbow tables do matter. If you don't protect against them, they immediately become effective again. Your argument is "bump keys exist for locks, better take them off the doors!"
- krainboltgreene 15y agoI think the better point here is: Bump keys exist for locks, lets not rely on them as a strong point for security.
- getsat 15y agoRainbow tables are even more useless than I had thought. See: http://news.ycombinator.com/item?id=2546835 http://news.ycombinator.com/item?id=2546835
- mrb 15y agoYou are off by an order of magnitude: a single GPU can do billions of hashes per second. HD 6970 = 5.5 billion MD5/s http://golubev.com/gpuest.htm http://golubev.com/gpuest.htm
- getsat 15y agoWow, the iMac my parents just bought has a 6970m in it. Things have progressed on this front faster than expected.