# Tag Info

15

Finding a decent explanation of rainbow tables was something I struggled with, so firstly I'll cover what they are. I will get to your question in the end. My sources for this are this guide and the wikipedia article. Why can't I just use a big bucket of hashes? Firstly the naive way to build a reverse lookup table is this. Let's say we want to generate ...

7

Rainbow tables are just a hyped-up name for tables of precomputed hash values with some trickery to allow for handling huuuuge tables in less huge storage space (e.g. mere terabytes). Precomputed tables, including rainbow tables, are utterly defeated by salting. Assuming you used a proper password hashing process, one which includes a salt and can be ...

7

The security goal behind SRP is that an attacker that could either pretend to be a client (and attempt to log into a server that knows the key), pretend to be a server (and allow clients that know the key to attempt to log in), or actively monitor (and modify) the communications between a valid client and a valid server, would learn nothing from an exchange, ...

4

If you add a truly random character into a truly random position of a word (uniformly chosen), you get "entropy of position" + "entropy of character" as addition to the entropy of the word. (Not exactly, it's a bit less). The entropy of character is the size of the possible characters. 64 possible characters would be $log2(64) = 6$ bits of entropy. Entropy ...

3

Solving a 256-bit discrete log is absolutely doable, and quite quickly, these days; there are public tools that can do it, though they may require some expertise to use. On that note, even a 1024-bit modulus is not particularly conservative: it is generally agreed that well-funded organizations today could break logs of that size as well, but at a very ...

2

Rainbow tables can be used with words out of a dictionary rather than letters out of a charset. The ophcrack vista liveCD is an example. In contains two dictionaries and tries combinations of words as well as modifications. For example the main dictionary contains "house" and "boat" and the second dictionary has "2010" "2011" "january". It will then ...

2

"Brute force" is a loosely-defined traditional expression to designate a kind of attack of low mathematical cleverness, namely trying all possible values for some unknown. For instance, in the context of symmetric encryption with AES, using a 128-bit key, "bruteforcing" would be trying all possible sequences of 128 bits as possible keys, until one matches ...

2

The question is well answered by ninefingers, but the question exposes fundamental confusion on the part of Mitchell. The NT Hash is not salted, and it IS PASSWORD EQUIVALENT. There is no need to use the hash to get the password, just use the hash to access the resource! Second, the password must be greater than 14 characters to avoid the LM hash, see MS ...

2

I believe that you are talking about one specific version of EKE, which is one of several known Password authenticated key agreement methods (which is the general category of methods that do a key agreement with the property that someone listening into the exchange can't learn anything, and an attacker that poses as one of the two sides can learn no more ...

2

Being able to solve the discrete logarithm in SRP-6 allows an eavesdropping attacker to dictionary attack the password. It will not directly reveal a strong password or its hash. It requires the attacker to observe a successful authentication, $B$ alone does not suffice. The attacker eavesdrops $s$, $A = g^a$, $B$ and $M_1$. The attacker solves $a$ from ...

2

"Would it be possible for an attacker to launch an offline dictionary/brute-force attack on the B public key: ..." That is possible if and only if the attacker can distinguish b's distribution from the uniform distribution on {0,1,2,3,...,N-3,N-2}. $\:$ If so, an attacker could compute verifiers v for candidate passwords, subtract kv from B mod N, and ...

1

If you have a secret key (256-bits) shared between the two systems that see the entity identifiers, you can use HMAC-SHA256 to map entity identifiers to a random string. Under the assumption that HMAC-SHA256 security is good (which is widely believed to be a reasonable one), this is just as secure as having generated a truly random mapping, but requires ...

1

Suppose the server did not include $v$ in the computation of $B$. In such case the following events have happened: The server has sent a salt value $s$ to the client. We might assume it is authentic (because it is easy for the fake server to get it from the real server). The client re-calculates its long term private key $x$ such that $v = g^x$. The client ...

1

But this proof value must be something both the client and the (legitimate) server can compute, and thus it must be entirely determined by: values chosen by the client and sent to the server during the authentication process, values chosen by the server and sent to the client during the authentication process, and the password and/or the ...

1

Brute forcing the password, since no useful cryptanalysis of ICE is known. I'm really more of a theory guy, so I don't know of any tools for this, but there are some resources that I've found. http://security.stackexchange.com/questions/1376/where-can-i-find-good-dictionaries-for-dictionary-attacks answers its title's question, and ...

1

Based on the comments, it sounds like you know all the requirements/restrictions on the key. One thing that is not clear is if you have a good way of determining if a trial decryption resulted in the proper plaintext. This is usually not a difficult requirement as most data has some structure you could look for. Another important piece of information you are ...

1

In the context of block ciphers like DES, or historical ciphers, the usual terminology is that a brute force attack enumerates all the keys to find one matching all intercepted data; in this context, dictionary attack is sometime used to describe an attack where a number of correspondences between known plaintext and ciphertext are accumulated, forming a ...

1

As far as I know, NTLM v2 uses a MD5 HMAC with the user password as the key and the MD4 hash of the concenation of user name and domain. MD5 itself isn't very secure as a hash (collisions are trivially to find), but it retains some value for applications like this one, since the best know preimage attack has about $2^{123}$ complexity (so almost the full ...

Only top voted, non community-wiki answers of a minimum length are eligible