22 ms·
But with a per-user salt, they would have to attack each password individually, using each of these techniques with each given salt and hope for a coincidence w
by claudius 13y ago
But with a per-user salt, they would have to attack each password individually, using each of these techniques with each given salt and hope for a coincidence with the stored hash, rather than run their techniques and compare the resulting hashes to the stored ones? Something like:
Global hash:
while(s = guess()) {
if (md5(s,salt) in list) {
print s;
delete(md5(s,salt),list);
}
}
Unique hash:
while(s = guess()) {
foreach(h in list) {
if (md5(s,salt)==h) {
print s;
delete(h,list);
}
}
}
The former requires one md5 calculation and one lookup per guess, the latter needs n md5 calculations per guess. That certainly is quite a difference, assuming the bottleneck to be md5.