3 ms·
"One-way encryption" is a peculiar choice of phrase.
by kmfrk 14y ago
"One-way encryption" is a peculiar choice of phrase.
- deleted 14y ago[deleted]
- menacingly 14y agoHow is it an oxymoron?
- UnoriginalGuy 14y agoAn oxymoron is two words which mean the opposite but yet the two combined words form a new expression which remains "true." For example "bitter sweet." Bitter and sweet mean two different opposite things, but the two words together are "true" because something can be both bitter and sweet. Encryption means simply to convert information into a form which cannot be easily read by an unauthorised party. One way or lossy encryption is not a contradiction of that.
- floody-berry 14y agoEncryption implies that an authorized party can also decrypt/read the encrypted data. In that sense, "one way" + "encryption" is an oxymoron. Further, "one way encryption" appears to only exist so nobody has to explain to regular users (and a lot of developers apparently) what is actually being done with their passwords.
- benaiah 14y ago"One way encryption" == hashing. Maybe not the best term, but it's pretty obvious what they mean.
- lucian1900 14y agoIt's easier to understand by lay persons than hashing.
- Evbn 14y agoIt goes to efficient write-only memory. Or the author is not qualified to do security, or thinks readers are ignorant.
- apawloski 14y agoMeh, it's a PR person who probably had it explained 10 minutes before. They explicitly state that they are hashed and salted, so I'm not super concerned.
- kmfrk 14y agoSomeone should write a boilerplate "we've been hacked" blog post with parameters for the kind of hashing and factors of authentication used, and what they know - or don't know - was compromised. I can't blame companies for not having one such on hand to begin with, but I'm sure they'd appreciate that someone with the unfortunate experience crafted a draft for them in stressful times like these.
- sdevlin 14y agoDepending on how they're hashed, that may or may not be an effective countermeasure.
- UnoriginalGuy 14y agoNo, it is an accurate choice of phase. The passwords are "hashed" which is literally one-way encryption, since the encryption is lossy - the information to reverse it literally doesn't exist in the output. The only way to "break" correctly working hashes is to encrypt tons of passwords (+salt) and see if the lossy output is identical to the output you got from the previously hashed password. Which is a very time consuming and computably expensive process (in particular when using something newer/better than MD5/3DES).
- apawloski 14y agoPeople are going to argue with you semantically, but you'll all generally be in agreement (except 3DES is a block cipher, not a hash function).
- UnoriginalGuy 14y ago3DES is a black cipher but block ciphers can be used for hashing. 3DES in particular was used on UNIX/Linux based systems quite extensively. http://www.freebsd.org/doc/handbook/crypt.html http://www.freebsd.org/doc/handbook/crypt.html See this: http://en.wikipedia.org/wiki/One-way_compression_function#Construction_from_block_ciphers http://en.wikipedia.org/wiki/One-way_compression_function#Co...
- apawloski 14y agoYeah, in retrospect I should have realized that (especially with bcrypt, also made from a block cipher, being the current standard for password storage). I didn't know DES was actually used for hashing though (perhaps unfortunately revealing my younger age and naiveté :)
- quinndupont 14y agoAll cryptography is fundamentally transposition and substitution of "symbols" (across a combinatoric space, an "alphabet"). Hash functions can be made from block ciphers, but really, symmetric and asymmetric crypto is just moving around some letters, but in interesting, deterministic ways.
- deleted 14y ago[deleted]