3 ms·

Your second point might be dangerous - your salt values are no longer random but heavily biased and knowing that all salt values share some common bits might pr

by danbruc 12y ago

Your second point might be dangerous - your salt values are no longer random but heavily biased and knowing that all salt values share some common bits might provide a new attack vector.

antsar 12y ago
Is this true? I would think that static bits are no more dangerous than not having the bits at all.
- danbruc 12y ago
  Here is for example an attack recovering a 384 bit ECDSA key [1] by knowing the five least significant bits of the nonce (obtained by a side channel attack) for 4000 signatures. Now hashes and signatures are obviously very different things but I would not bet on the fact that a bias in the salt does not matter. [1] https://eprint.iacr.org/2013/346.pdf https://eprint.iacr.org/2013/346.pdf
  - antsar 12y ago
    Interesting. Thanks for the link!
  - dchest 12y ago
    ECDSA is a completely different beast. I'm not aware of a modern password hashing function that would be broken if it was given a non-uniformly random salt. If such function were to be submitted to PHC (https://password-hashing.net/ https://password-hashing.net/), I would consider it to be a disqualifying factor. For password hashing purposes, salt doesn't need to be uniformly random, the only requirement for salt is to be unique and unpredictable to the attacker (see http://crypto.stackexchange.com/questions/6119/hashing-passwords-with-a-salt-why-use-different-salt-for-everyone/6132#6132 http://crypto.stackexchange.com/questions/6119/hashing-passw...). Most password hashing functions use a cryptographic hash on salt. This particular function, scrypt, uses one-round PBKDF2-HMAC-SHA256 to mix password and salt: https://github.com/golang/crypto/blob/master/scrypt/scrypt.go#L236 https://github.com/golang/crypto/blob/master/scrypt/scrypt.g... PBKDF2 feeds salt, basically, into SHA256: https://github.com/golang/crypto/blob/master/pbkdf2/pbkdf2.go#L55 https://github.com/golang/crypto/blob/master/pbkdf2/pbkdf2.g...
    - danbruc 12y ago
      If there was a known attack it would obviously be a non-starter. But why take the risk that someone will come up with something comparable - in the broadest sense - to say the differential attack on MD5 that allows exploiting known bits in the salt if there is no need to?

by danbruc 12y ago

Your second point might be dangerous - your salt values are no longer random but heavily biased and knowing that all salt values share some common bits might provide a new attack vector.

antsar 12y ago

Is this true? I would think that static bits are no more dangerous than not having the bits at all.

danbruc 12y ago
Here is for example an attack recovering a 384 bit ECDSA key [1] by knowing the five least significant bits of the nonce (obtained by a side channel attack) for 4000 signatures. Now hashes and signatures are obviously very different things but I would not bet on the fact that a bias in the salt does not matter. [1] https://eprint.iacr.org/2013/346.pdf https://eprint.iacr.org/2013/346.pdf
- antsar 12y ago
  Interesting. Thanks for the link!
- dchest 12y ago
  ECDSA is a completely different beast. I'm not aware of a modern password hashing function that would be broken if it was given a non-uniformly random salt. If such function were to be submitted to PHC (https://password-hashing.net/ https://password-hashing.net/), I would consider it to be a disqualifying factor. For password hashing purposes, salt doesn't need to be uniformly random, the only requirement for salt is to be unique and unpredictable to the attacker (see http://crypto.stackexchange.com/questions/6119/hashing-passwords-with-a-salt-why-use-different-salt-for-everyone/6132#6132 http://crypto.stackexchange.com/questions/6119/hashing-passw...). Most password hashing functions use a cryptographic hash on salt. This particular function, scrypt, uses one-round PBKDF2-HMAC-SHA256 to mix password and salt: https://github.com/golang/crypto/blob/master/scrypt/scrypt.go#L236 https://github.com/golang/crypto/blob/master/scrypt/scrypt.g... PBKDF2 feeds salt, basically, into SHA256: https://github.com/golang/crypto/blob/master/pbkdf2/pbkdf2.go#L55 https://github.com/golang/crypto/blob/master/pbkdf2/pbkdf2.g...
  - danbruc 12y ago
    If there was a known attack it would obviously be a non-starter. But why take the risk that someone will come up with something comparable - in the broadest sense - to say the differential attack on MD5 that allows exploiting known bits in the salt if there is no need to?