2 ms·

Am I the only one a bit surprised that the feed from the FBI will be NTLM and SHA1 hashes? (especially the NTLM) Would it make more sense to break the NTLM has

Am I the only one a bit surprised that the feed from the FBI will be NTLM and SHA1 hashes? (especially the NTLM) Would it make more sense to break the NTLM hashes and then to rehash with something more secure (even a better SHA, like SHA256) This is not quite as feasible for SHA1 (but it actually might be, even in bulk -- this was 9 years ago[0]!) as for NTLM, but I remember cracking NTLM hashes in bulk back in the late 90's on .3 Ghz servers, and I'm sure it would take a heartbeat to do it today. 0. https://arstechnica.com/information-technology/2012/12/oh-great-new-attack-makes-some-password-cracking-faster-easier-than-ever/ https://arstechnica.com/information-technology/2012/12/oh-gr...

bawolff 5y ago
I suspect its not that the fbi has ntlm/sha1 hashes as their base data set, but that they dont want to give out the actual passwords and settled on these two hashes instead. I think HIBP was already giving out their dataset in this format. Fwiw, sha1, 256 or even md5 have similar levels of security when it comes to password hashing. The security properties you want for password hashing are very different than normal hashing.
deleted 5y ago
[deleted]
KMag 5y ago
In what sense do you consider SHA-256 superior to SHA-1? If you're looking for preimage resistance, unless your passwords contain more than 128 bits of entropy, I suspect bruit forcing your password is still faster than a preimage attack on SHA-1, and will probably remain so for at least a decade. Collision attacks aren't useful for passwords (attacker chooses two passwords such that they have the same hash... I can't imagine a threat model under which this is useful to the attacker if that hash doesn't match any target's password hash. Maybe there is such a threat model, but it has to be a very outside-the-box attack.) If you're worried about effort needed to bruit-force the password, use Argon2 or another memory-hard password hash/KDF.

bawolff 5y ago

I suspect its not that the fbi has ntlm/sha1 hashes as their base data set, but that they dont want to give out the actual passwords and settled on these two hashes instead. I think HIBP was already giving out their dataset in this format. Fwiw, sha1, 256 or even md5 have similar levels of security when it comes to password hashing. The security properties you want for password hashing are very different than normal hashing.

deleted 5y ago

[deleted]

KMag 5y ago

In what sense do you consider SHA-256 superior to SHA-1? If you're looking for preimage resistance, unless your passwords contain more than 128 bits of entropy, I suspect bruit forcing your password is still faster than a preimage attack on SHA-1, and will probably remain so for at least a decade. Collision attacks aren't useful for passwords (attacker chooses two passwords such that they have the same hash... I can't imagine a threat model under which this is useful to the attacker if that hash doesn't match any target's password hash. Maybe there is such a threat model, but it has to be a very outside-the-box attack.) If you're worried about effort needed to bruit-force the password, use Argon2 or another memory-hard password hash/KDF.