3 ms·
The higher the entropy of the salt the better. Let's say everyone did as you propose and use usernames for salts. I could pre-compute dictionaries for usernam
by jfarmer 14y ago
The higher the entropy of the salt the better.
Let's say everyone did as you propose and use usernames for salts. I could pre-compute dictionaries for usernames like root, admin, etc. and likely gain full access to a wide range of systems.
Our aim is to build a system where brute-forcing is always the cheapest option. Once that's the case, we're in a position to control "how expensive" it is for someone to invert even one derived key.
- jules 14y agoPresumably each username on Mega is unique, so that precomputation won't give you anything.
- jiggy2011 14y agoPerhaps the point is to reduce the risk that a rainbow table already created for some other use could be used in this case?
- jules 14y agoThat would at most reduce the number of KDF calls an attacker would need to perform by a factor of 2, if (1) the other service is using exactly the same KDF (2) all the usernames are identical in the two services. If not all the usernames are identical, then the factor of 2 is even lower. If an attacker can perform n calls to a KDF then he can also perform 2n calls to it, so if you're relying on that factor of 2 for security you have a problem no matter what. In any case this is easily defeated by adding a random string: KDF(username + "|blablafoo|" + password).
- jiggy2011 14y agoYes, this would be true in the case of adding a random string as a second salt but then this would have to be sent to the client also. I am not sufficiently familiar with KDFs but I know that rainbow tables exist to crack straight up md5 hashed passwords for common usernames and passwords where the username has been used as the salt. Maybe harder to do with a KDF because it's prohibitive to compute that many keys in the first place?
- jfarmer 14y agoUnique inside Mega, yes, but not globally. Imagine if UNIX systems did as you propose. The rainbow table for the salt "root" would let me do plenty of damage.