3 ms·
Maybe I'm misunderstanding how the hashes are being cracked, but I was under the impression that this is cycling through all possible inputs, hashing them, and
by chengas123 17y ago
Maybe I'm misunderstanding how the hashes are being cracked, but I was under the impression that this is cycling through all possible inputs, hashing them, and comparing to the given user input. However, I believe the original value is restricted to being 8 characters long (assuming that's what this means: "capable of searching the full 8-character keyspace (from a 64-character set)"). By salting your hash, you make the input to the hash function much larger. Then it's quite a bit over 8 characters and no longer feasible to crack.
- tptacek 17y agoThe salt value is public. You don't have to brute force it. This isn't a "rainbow table"; it's exhausting the secret input to the hash function itself. Your analysis is broken.
- chengas123 17y agoSalts are never public. You're assuming that the salt is obtained along with the hash, which may sometimes but not always be true. However, I did understate the usefulness of this method since I was assuming the attacker doesn't have the salt, which often may not be the case.