4 ms·

I am the creator of YPassword, and each time I asked if my algorithm was secure I stumbled upon a lot of people not understanding anything about cryptography th

I am the creator of YPassword, and each time I asked if my algorithm was secure I stumbled upon a lot of people not understanding anything about cryptography that claimed to me: "Hey! sha1 is sooo absolutely insecure! Use bcrypt!" :-/ "Hey! bcrypt is sooo incredibly insecure! Use scrypt!" (only implemented in C). You know what? I finished to read the scrypt paper. In fact _theoretically_ scrypt is far more secure than bcrypt, himself (AFAIK) better than PBKDF1. And the general algorithm behind scrypt is _simple_. Not as simple as sha1^n but almost as simple. I tried to answer my theoretical question two times now. Each time I never meet any real security expert, only a bunch of zealot. And I know they are all zealot because I discussed with a lot of security expert (searchers) during my Ph. D. And I know far more about security than people reading my question might think. Even if it feels like, my question is _not_ a newbie question. But I am not an expert either. I try my chance with you dear HNers. Here is the question: Let sha1(salt|pass)=S Knowing "salt" and "S", is there a known attack better than brute force to discover "pass" or sha1(salt2|pass) where salt2 is known and dependent only of salt (for example salt2 = salt + 1)?

tptacek 15y ago
This is exactly the kind of batshit comment I'm talking about when I say Salvatore shouldn't be calling bcrypt "dogma", even when not using bcrypt is a reasonable choice for him. In the nineteen seventies, Unix password files had random per user salts --- not salts derived from one another, but random ones --- and those password hashes were better than this one.
- yogsototh 15y ago
  Hi! As you are an expert in the domain, do you know if my method to generate personal password seems secure? Typically, instead of memorizing a lot of random password, I memorize only one password and for each website I use the password: sha1(password|domainname) Until here nobody give me a clear answer, and therefore I assume it is secure while not any flaw is discovered. And more precisely, I use sha1(password|number|domainname) because, if I fear my password was discovered, I change it by incrementing the number. I would be very grateful if you mind answer my question. Thanks!
  - JoachimSchipper 15y ago
    That's vulnerable to a length extension attack: sha1(passwd|am) can be used to derive sha1(passwd|amazon). (See Wikipedia for a discussion.) Don't try to get clever, just use random passwords.
    - yogsototh 15y ago
      Thank you so much! It is exactly what I was looking for.
dchest 15y ago
a known attack better than brute force Here's your problem -- it's a wrong question. "Better than brute force" doesn't mean that the brute force attack is practically unfeasible.
- yogsototh 15y ago
  Your problem is you assumed I use my method to encrypt user password. Not at all. I use my method to generate personal password. And I know I use a very secure master password which make brute force attack practically unfeasible. My main password is more than 16 char long. I continue to believe I didn't asked a wrong question. But you may know an answer.
skeptical 15y ago
If there is, most of the people don't know about it, but will still jump in to defend their dogmas till the last drop of sweat. I'm a cryptography illiterate, I know zero besides the basics, i.e. common sense. But it does annoy me deeply, the amount of people talking about cryptography with a pretentious attitude. I am glad you ask that question, and I'm suspecting nobody will say 'yes'.
- yogsototh 15y ago
  The main problem with this question is I get a lot a answer that simply aren't answer to this question, but only the basic good usage of cryptography. Until here, nobody said 'yes', then I assume my method is secure. I would have loved to know if this specific question is asked for any kind of hash function, or if nobody never ask such question. For me it seems as a natural question which seem a bit more difficult than finding a collision but easier than cracking completely the hash function.
  - dchest 15y ago
    To answer your question, AFAIK there are no known first preimage attacks on SHA-1 yet. And no, your method is not secure.
    - yogsototh 15y ago
      Thanks for your answer. Could you explain me how my method is not secure assuming: 1. The pass is long 2. The preimage is known If nobody can find `sha1(knownpart|hiddenpart)`, how is my method insecure? Is the problem linked to sha1 or if I use any other hash this method also fail? I presume the _only_ method you advocate for is to have a lot of different passwords for each website is to store randomly generated password inside a keychain system. Could you enlighten me? How do you deal with your own password? Thanks. edit: it seems we reached the max depth. Thank you Dmitry!
      - dchest 15y ago
        Table on estimated cost of hardware to crack a password in 1 year from scrypt paper: http://i.imgur.com/sAOwS.png http://i.imgur.com/sAOwS.png I personally use a scheme similar to yours, but with PBKDF2. Also, I'm no crypto expert.

tptacek 15y ago

This is exactly the kind of batshit comment I'm talking about when I say Salvatore shouldn't be calling bcrypt "dogma", even when not using bcrypt is a reasonable choice for him. In the nineteen seventies, Unix password files had random per user salts --- not salts derived from one another, but random ones --- and those password hashes were better than this one.

yogsototh 15y ago
Hi! As you are an expert in the domain, do you know if my method to generate personal password seems secure? Typically, instead of memorizing a lot of random password, I memorize only one password and for each website I use the password: sha1(password|domainname) Until here nobody give me a clear answer, and therefore I assume it is secure while not any flaw is discovered. And more precisely, I use sha1(password|number|domainname) because, if I fear my password was discovered, I change it by incrementing the number. I would be very grateful if you mind answer my question. Thanks!
- JoachimSchipper 15y ago
  That's vulnerable to a length extension attack: sha1(passwd|am) can be used to derive sha1(passwd|amazon). (See Wikipedia for a discussion.) Don't try to get clever, just use random passwords.
  - yogsototh 15y ago
    Thank you so much! It is exactly what I was looking for.

dchest 15y ago

a known attack better than brute force Here's your problem -- it's a wrong question. "Better than brute force" doesn't mean that the brute force attack is practically unfeasible.

yogsototh 15y ago
Your problem is you assumed I use my method to encrypt user password. Not at all. I use my method to generate personal password. And I know I use a very secure master password which make brute force attack practically unfeasible. My main password is more than 16 char long. I continue to believe I didn't asked a wrong question. But you may know an answer.

skeptical 15y ago

If there is, most of the people don't know about it, but will still jump in to defend their dogmas till the last drop of sweat. I'm a cryptography illiterate, I know zero besides the basics, i.e. common sense. But it does annoy me deeply, the amount of people talking about cryptography with a pretentious attitude. I am glad you ask that question, and I'm suspecting nobody will say 'yes'.

yogsototh 15y ago
The main problem with this question is I get a lot a answer that simply aren't answer to this question, but only the basic good usage of cryptography. Until here, nobody said 'yes', then I assume my method is secure. I would have loved to know if this specific question is asked for any kind of hash function, or if nobody never ask such question. For me it seems as a natural question which seem a bit more difficult than finding a collision but easier than cracking completely the hash function.
- dchest 15y ago
  To answer your question, AFAIK there are no known first preimage attacks on SHA-1 yet. And no, your method is not secure.
  - yogsototh 15y ago
    Thanks for your answer. Could you explain me how my method is not secure assuming: 1. The pass is long 2. The preimage is known If nobody can find `sha1(knownpart|hiddenpart)`, how is my method insecure? Is the problem linked to sha1 or if I use any other hash this method also fail? I presume the _only_ method you advocate for is to have a lot of different passwords for each website is to store randomly generated password inside a keychain system. Could you enlighten me? How do you deal with your own password? Thanks. edit: it seems we reached the max depth. Thank you Dmitry!
    - dchest 15y ago
      Table on estimated cost of hardware to crack a password in 1 year from scrypt paper: http://i.imgur.com/sAOwS.png http://i.imgur.com/sAOwS.png I personally use a scheme similar to yours, but with PBKDF2. Also, I'm no crypto expert.