3 ms·

No, it is an accurate choice of phase. The passwords are "hashed" which is literally one-way encryption, since the encryption is lossy - the information to reve

No, it is an accurate choice of phase. The passwords are "hashed" which is literally one-way encryption, since the encryption is lossy - the information to reverse it literally doesn't exist in the output. The only way to "break" correctly working hashes is to encrypt tons of passwords (+salt) and see if the lossy output is identical to the output you got from the previously hashed password. Which is a very time consuming and computably expensive process (in particular when using something newer/better than MD5/3DES).

apawloski 14y ago
People are going to argue with you semantically, but you'll all generally be in agreement (except 3DES is a block cipher, not a hash function).
- UnoriginalGuy 14y ago
  3DES is a black cipher but block ciphers can be used for hashing. 3DES in particular was used on UNIX/Linux based systems quite extensively. http://www.freebsd.org/doc/handbook/crypt.html http://www.freebsd.org/doc/handbook/crypt.html See this: http://en.wikipedia.org/wiki/One-way_compression_function#Construction_from_block_ciphers http://en.wikipedia.org/wiki/One-way_compression_function#Co...
  - apawloski 14y ago
    Yeah, in retrospect I should have realized that (especially with bcrypt, also made from a block cipher, being the current standard for password storage). I didn't know DES was actually used for hashing though (perhaps unfortunately revealing my younger age and naiveté :)
  - quinndupont 14y ago
    All cryptography is fundamentally transposition and substitution of "symbols" (across a combinatoric space, an "alphabet"). Hash functions can be made from block ciphers, but really, symmetric and asymmetric crypto is just moving around some letters, but in interesting, deterministic ways.
gameshot911 14y ago
If the output is lossy and doesn't contain all the info needed to reverse it, is it possible to guaranteeing that each each output is unique? Or could two different inputs theoretically create the same lossy output?
- ocharles 14y ago
  It depends on your hashing function. What you're talking about is a https://en.wikipedia.org/wiki/Collision_(computer_science) https://en.wikipedia.org/wiki/Collision_(computer_science)
- UnoriginalGuy 14y ago
  Each output is NOT unique. Since it can take in an almost unlimited amount of data and output a set length string we know for a fact collisions will eventually occur. The question is - can we predict these collisions or guestimate when they might occur without having to actually try every combination? If the answer is "yes" then the hashing algorithm is broken (see MD5).
floody-berry 14y ago
"hashed and salted" is not necessarily time consuming, it really matters what process they used. Their post gives no confidence that the passwords cannot be trivially cracked.

apawloski 14y ago

People are going to argue with you semantically, but you'll all generally be in agreement (except 3DES is a block cipher, not a hash function).

UnoriginalGuy 14y ago
3DES is a black cipher but block ciphers can be used for hashing. 3DES in particular was used on UNIX/Linux based systems quite extensively. http://www.freebsd.org/doc/handbook/crypt.html http://www.freebsd.org/doc/handbook/crypt.html See this: http://en.wikipedia.org/wiki/One-way_compression_function#Construction_from_block_ciphers http://en.wikipedia.org/wiki/One-way_compression_function#Co...
- apawloski 14y ago
  Yeah, in retrospect I should have realized that (especially with bcrypt, also made from a block cipher, being the current standard for password storage). I didn't know DES was actually used for hashing though (perhaps unfortunately revealing my younger age and naiveté :)
- quinndupont 14y ago
  All cryptography is fundamentally transposition and substitution of "symbols" (across a combinatoric space, an "alphabet"). Hash functions can be made from block ciphers, but really, symmetric and asymmetric crypto is just moving around some letters, but in interesting, deterministic ways.

gameshot911 14y ago

If the output is lossy and doesn't contain all the info needed to reverse it, is it possible to guaranteeing that each each output is unique? Or could two different inputs theoretically create the same lossy output?

ocharles 14y ago
It depends on your hashing function. What you're talking about is a https://en.wikipedia.org/wiki/Collision_(computer_science) https://en.wikipedia.org/wiki/Collision_(computer_science)
UnoriginalGuy 14y ago
Each output is NOT unique. Since it can take in an almost unlimited amount of data and output a set length string we know for a fact collisions will eventually occur. The question is - can we predict these collisions or guestimate when they might occur without having to actually try every combination? If the answer is "yes" then the hashing algorithm is broken (see MD5).

floody-berry 14y ago

"hashed and salted" is not necessarily time consuming, it really matters what process they used. Their post gives no confidence that the passwords cannot be trivially cracked.