2 ms·
I mean sha-1 is for sure broken, but I thought that was mainly concerning stuff like collisions via a length extension attack and other known plaintext attacks.
by monocasa 3y ago
I mean sha-1 is for sure broken, but I thought that was mainly concerning stuff like collisions via a length extension attack and other known plaintext attacks.
Finding what amounts to a passphrase just given a hash was still generally untractable I thought.
- tptacek 3y agoIt's a simple dictionary attack, which is how most password hashes are broken. This has really nothing to do with SHA1 itself.
- woodruffw 3y agoYes, SHA-1 is still considered preimage resistant. But preimage resistance isn't that important here, if the hypothesis about seed structure is correct: SHA-1 is also very fast and trivial to parallelize, and someone dedicated to exploring the permutation space of "Jerry needs a raise" stands a decent chance of discovering the original input.
- monocasa 3y agoExcept the Jerry needs a raise story has been floating around for a while now. The obvious choices have been mined out.
- tedunangst 3y agoHow much actual effort has been spent mining this space?
- woodruffw 3y agoI hadn't heard it before. Whether or not it's an old story is secondary to visibility/mass awareness.