5 ms·
I would imagine you have to try a different password each time.
by Negitivefrags 14y ago
I would imagine you have to try a different password each time.
- dangrossman 14y agoWhy would you imagine that? The bug is that what password you provide doesn't matter.
- Negitivefrags 14y agoThat wasn't how I read it. It sounds like they were casting the result of a memcmp to a char. A char only has a range of -128 to 127. The resulting overflow means that an arbitrary password hash has a 1/255 chance of landing on 0, but you still have to try a bunch to hit one.
- mike-cardwell 14y agoThis is incorrect. You do not need to try a different password each time.
- tedunangst 14y agoThe password is combined with a random value on each attempt, the hash will change each time.
- seppo0010 14y agomemcmp will probably return always the same value for the same parameters, which may not trigger the error. Trying different values may yield a value whose mod is 0.