3 ms·

Is this true? I would think that static bits are no more dangerous than not having the bits at all.

• danbruc 12y ago
  Here is for example an attack recovering a 384 bit ECDSA key [1] by knowing the five least significant bits of the nonce (obtained by a side channel attack) for 4000 signatures. Now hashes and signatures are obviously very different things but I would not bet on the fact that a bias in the salt does not matter. [1] https://eprint.iacr.org/2013/346.pdf https://eprint.iacr.org/2013/346.pdf
  • antsar 12y ago
    Interesting. Thanks for the link!
  • dchest 12y ago
    ECDSA is a completely different beast. I'm not aware of a modern password hashing function that would be broken if it was given a non-uniformly random salt. If such function were to be submitted to PHC (https://password-hashing.net/ https://password-hashing.net/), I would consider it to be a disqualifying factor. For password hashing purposes, salt doesn't need to be uniformly random, the only requirement for salt is to be unique and unpredictable to the attacker (see http://crypto.stackexchange.com/questions/6119/hashing-passwords-with-a-salt-why-use-different-salt-for-everyone/6132#6132 http://crypto.stackexchange.com/questions/6119/hashing-passw...). Most password hashing functions use a cryptographic hash on salt. This particular function, scrypt, uses one-round PBKDF2-HMAC-SHA256 to mix password and salt: https://github.com/golang/crypto/blob/master/scrypt/scrypt.go#L236 https://github.com/golang/crypto/blob/master/scrypt/scrypt.g... PBKDF2 feeds salt, basically, into SHA256: https://github.com/golang/crypto/blob/master/pbkdf2/pbkdf2.go#L55 https://github.com/golang/crypto/blob/master/pbkdf2/pbkdf2.g...
    • danbruc 12y ago
      If there was a known attack it would obviously be a non-starter. But why take the risk that someone will come up with something comparable - in the broadest sense - to say the differential attack on MD5 that allows exploiting known bits in the salt if there is no need to?