4 ms·
Using the same key 3 times would be equivalent to using 1 key and performing 1 encrypt operation. It is almost certainly not the case that adobe is using the s
by theboss 13y ago
Using the same key 3 times would be equivalent to using 1 key and performing 1 encrypt operation.
It is almost certainly not the case that adobe is using the same key for all 3 operations. It's probably more effort to do anyways
- alexkus 13y agoAh yes, I was getting the various Keying options mixed up in my head:- http://en.wikipedia.org/wiki/Triple_DES#Keying_options http://en.wikipedia.org/wiki/Triple_DES#Keying_options [EDIT] It does seem odd though that the passwords are encrypted and not hashed, but the hints are in plaintext. Why didn't they also encrypt the hints? (Rhetorical, the answer is probably just laziness/incompetence). Even if you do use bcrypt() or similar for hashing the passwords then encrypting the hints would prevent similar tactics being available from just a dump of the table contents.
- theboss 13y agoHashing is the correct way but big companies commonly do things wrong. If they had a sqli vulnerability in their site without knowing it's also possible that they didn't even know this database existed.