3 ms·
If there are 12^2 = 144 boxes total, you only need to open 2. Not 12 as you said. Put differently: with x^y nested boxes, you only have to open y. The attacker
by cl3misch 4y ago
If there are 12^2 = 144 boxes total, you only need to open 2. Not 12 as you said.
Put differently: with x^y nested boxes, you only have to open y. The attacker has to open x^y.
- Dylan16807 4y agoNo, you're thinking of something different, like making the password more complex. While they made it confusing by using "12" for two different things, their analogy is completely correct. Instead of each password/location having one box, it has a box within a box within a box[...]. You have to unwrap the entire stack to check if the treasure is there. If you use an iteration count of 5000, then when you log in you unfortunately have to do 5000 hashes. But an attacker has to do 5000 hashes per password guess. So a deep iteration count can't substitute for a good password, but it can make up for an extra few characters. And it's basically free to increase iterations until the wait becomes visible.