4 ms·
If inverting bcrypt(md5(.)) was easy then you'd have a preimage attack on md5: given your value md5(x), compute a bcrypt digest of that and attack that instead
by shrughes 14y ago
If inverting bcrypt(md5(.)) was easy then you'd have a preimage attack on md5: given your value md5(x), compute a bcrypt digest of that and attack that instead. (Which is not exactly the same as inverting bcrypt(md5(.)) given a dictionary of likely inputs, though.)
Anyway, if there's any input set X for which bcrypt(X) can be inverted more efficiently than brute force, then you could say that bcrypt is flawed. If that set is the random-looking hashes of user passwords, instead of a carefully constructed one designed to attack bcrypt, then you can safely say bcrypt is catastrophically broken.
- yummyfajitas 14y agoAnyway, if there's any input set X for which bcrypt(X) can be inverted more efficiently than brute force, Here is one: [ (bcrypt x salt) | x <- dictionary, salt <- all_bcrypt_salts ] Now I do think it's unlikely that range(md5) is a good domain on which to attack bcrypt, but I also recognize I'm not smart enough to be sure.
- shrughes 14y agoI don't get what you're saying here. Is your input set a bunch of outputs of bcrypt? Is your input set `dictionary`? Either way, how can you invert the output of bcrypt more efficiently than brute force?
- yummyfajitas 14y agoIn my particular example, you need only brute force it over a dictionary, which is not that hard to do (even for bcrypt). That's because the input set for bcrypt is being artificially constrained. My concern is that artificially constraining the input set to range(md5) might similarly make brute forcing (or other attacks) easier.