New answers tagged

0

The purpose of pepper in your scheme is strange. If you want to prove that you have a record "John Smith", you cannot do it without showing the pepper field. And if you show this field, then you cannot call it pepper, because pepper is something that only you know and that you don't show to anyone. Means, the correct name for this field would be ...


3

The question's construction is an attempt at making a memory-hard function. This is more difficult than it seems, and the construction proposed has several flaws: An adversary performing a password dictionary attack needs only a little over half a megabyte of memory per concurrently running process. This is because adversaries are not bound to "put 31,...


1

Both a hash (like SHA-1) and a cipher (like RSA) are designed to not be reversible. That is, given their outputs (the digest or ciphertext) it should not be feasible to figure out what the input was. The value of a salt is not in making it harder to figure out what the password was from the hashed password. Passwords are often easy to guess. A salt makes it ...


2

Rainbow tables are essentially an optimized dictionary attack, which rely on two assumptions: That two different applications will hash the same input to the same output, e.g. the password "Password123" will always hash to "42f749ade7f9e195bf475f37a44cafcb". This allows the attacker to re-use a rainbow table database to attack multiple ...


5

I don't see a point of using RSA for password hashing. Using SHA and RSA will not make the bruteforce attack slower. The massive GPU/ASIC attacks will still work if we assume the public key $(e,n)$ is known. That is why we need memory hard functions to make the attacks slower. Sticking the standard is still better like using Argon2id ( Argon2 was the winner ...


4

What you are describing is called pepper. What you are doing is just using RSA as a cryptographic hash function. That probably reduces performance and makes your system more complicated. Generally, people install a random number directly in to the program as a literal. It is safe as long as your source code and binary is safe. You could use it as an RSA key, ...


2

Disclaimer: The following is tentative. Before the question I did not knew about client salt. The client salt is combined on the client side with the password. When that's used, the client no longer sends the password, but a password-equivalent obtained by hashing. Client salt is often deterministic and near-public, e.g. < DNS of the realm, converted to ...


1

Currently we use slow key derivation functions. If a hypothetical quantom computer could run these as fast as a classical computer (Which is a huge If) grover's algorithm would allow searching over the equivalent of the squared root of the password space. However even a sizeable quantom computer won't be able to do that. We will be seeing Shor's algorithm ...


4

If you want a "quick" way of determining how long it will take for bcrypt-n10, you can process by hand a very very VERY small subset of its calculation, then multiply that time by how many times the algorithm will use it. The round function is used many times, you can perform components just once to get a base time. There are operations on 32-bit ...


Top 50 recent answers are included