7 ms·
Can anyone explain why all the emphasis on hashing algorithms? Can't the attacker just treat the encrypted vault like a black box and brute force passwords agai
by TechBro8615 4y ago
Can anyone explain why all the emphasis on hashing algorithms? Can't the attacker just treat the encrypted vault like a black box and brute force passwords against it? Or is there some additional key material that needs to be guessed along with the password?
For example, if the master password is one of the 100k most common passwords, can the attacker loop through those passwords and attempt to open the vault with each? So there would only be 100k iterations required? Or does each check need its own set of iterations?
- creatonez 4y ago> Or does each check need its own set of iterations? This is exactly what a password-key derivation function is. Each check is an independent process involving the unique salt stored in cleartext. Normally (OWASP recommendations) each password check is about 310,000 iterations of SHA256, or a more complex construction like Argon2. The problem here is that LastPass had 5000 iterations of SHA256 for a lot of accounts, and some accounts mysteriously have even lower iteration counts.
- supertrope 4y agoEven if someone uses "123456" or "Password1," the salt will prevent the hashes from being identical. This means each vault has to be individually brute forced instead of having one master rainbow table. These key stretching operations can only add so much security. Obvious passwords fall first.