3 ms·
Use a salted hash like everybody else does with passwords?
by poizan42 11y ago
Use a salted hash like everybody else does with passwords?
- Pyxl101 11y agoThanks. Is it just a plaintext password? The exact mechanism wasn't obvious to me from the article, though I see the tech report has more detail. If authentication is based on storing a password on the key and sending it over the wire, then there's nothing to prevent capturing that and cloning a key. I guess that's the point. I agree that if the auth is a password challenge, then hashing it will prevent recovery of the key from the cylinder though. Sounds like their lock is really just a "digital key", with wires sending bits that take the place of tumblers.
- cheald 11y agoYou can't decrypt information or validate a public key's signature with the hash of a private key. You need the actual private key unencrypted at some point; we solve this in most of our certs by encrypting them with a password that the user has to enter to decrypt, but access to the unencrypted private key is absolutely required at some point. Hashing is for passwords, not for keys.