I have a Lyra2 project and I still have some problems understanding its principle.

I really found a problem when I read about sponge contruction. I found out that it's composed of 3 steps: absorbing, squeezing and duplexing and then we xor the (password, salt, ... ) with random numbers (state) so finally we get the password encrypted but then my problem is: it's not possible to decrypt it, isn't it? So probably I'll decrypt it using a dictionary but the thing is since I'm xoring with just random numbers then for the same word I'll have different encryption each time, won't I?

  • $\begingroup$ Would you mind editing your question to be more precise in asking then "I don't understand its principle"? What exactly do you understand and what not? The more you give us, the better we can help you. BTW: Welcome to Crypto.SE :) $\endgroup$ – SEJPM Feb 11 '17 at 13:46
  • $\begingroup$ I'm voting to re-open the question as it's now clear what the OP is asking for: "How does one verify a password hash if random numbers are involved, after all one can't decrypt the hash?" $\endgroup$ – SEJPM Feb 13 '17 at 12:02

From what I can tell, you've found the salt input to modern password hashing schemes which indeed accepts random numbers to hash the same password to different results on distinct invokations.

Now the idea of the salt is indeed to prevent the dictionary attacks you envisioned (if you keep the salt secret, in which case it becomes pepper) or at least force you to go throgh your entire dictionary for every single salt you encounter, which will take time and slow you down in breaking large databases of passwords. However, normally, all parameters for password hashes are specified (including the salt) and as such it is an entirely deterministic computation from the password and the stored parameters to verify the stored password hash.

Finally, yes: It's impossible to directly recover the password (or a valid password) from its hash as then the function would have failed its most important role which is to make it hard to recover the password.

  • $\begingroup$ but for example in the algorithm : for col = 0 to C-1 rand = H.duplexing_{rho}( M[row1][col] [+] M[prev0][col] [+] M[prev1][col], blen) M[row0][C-1-col] = M[prev0][col] ^ rand M[row1][col] = M[row1][col] ^ ( rand >>> omega ) we XOR the M[row][col] with a random number without talking about the salt $\endgroup$ – golda chin Feb 16 '17 at 17:25
  • $\begingroup$ @goldachin rand is just a name for a temporary variable if I read this right, which gets instantiated and assigned a value in a loop early and then used throughout. $\endgroup$ – SEJPM Feb 16 '17 at 20:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.