3 ms·
How would salting work in this scenario? Both devices would have to share the salt, wouldn’t they?
by mcculley 3y ago
How would salting work in this scenario? Both devices would have to share the salt, wouldn’t they?
- gruez 3y agoYou broadcast salt || SHA256(phone number || salt). If you know the original phone number, you can check whether it's a match.
- eknkc 3y agoAnd if you don’t know the phone number you can brute force that pretty easily and it’s all the same. How many bits of enthropy are there on phone numbers?
- deleted 3y ago[deleted]
- l3s2d 3y agoThis doesn't seem any more secure than broadcasting SHA256(phone number).
- judge2020 3y agoAll it does is marginally increase the cost of reverse engineering the sha2. Instead of having a rainbow table of every phone number’s salt, you generate one with that salt whenever you want to get the phone number it broadcasted.
- wkat4242 3y agoYeah and you probably won't even need to rainbow that because it's a pretty quick operation on a decent GPU. For example here in Spain we have only 100 million mobile numbers. That sounds like a lot but it's peanuts for a gpu. Going through the entire keyspace would take a fraction of a second because my 4090 can do 20 billion salted SHA256 hashes per second!