May 7th, 2009, 12:01 AM
|
|
Registered User
|
|
Join Date: May 2009
Posts: 1
Time spent in forums: 8 m 18 sec
Reputation Power: 0
|
|
|
Crypto Algorithm Question - Salted Hashes
Hi All,
I think I GET hashes but trying to cement my knowledge on SALTED hashes. Hoping someone might tell me if this statement is correct, incorrect or basically correct with a few additions.
Quote: (imagine you are hacking a plain old Unix Password file – nothing special)
Scenario 1 – no SALTED passwords.
- Usernames in Password file = 10
- Valid usable password words = 10 (i.e. must choose from 10 acceptable passwords) – e.g lemon, pear, apple, peach, watermelon, mandarin – etc : up to 10 fuits only, must use these passwords.
- The HASH tabled needed to brute force a username and password will have 10 hashed entries in it – i.e. each acceptable password word hashed.
Scenario 2- SALTED password – SALT value no secret.
- Usernames in password file = 10
- Valid usable password words = 10 (i.e. must choose from 10 acceptable passwords)
- SALT is unique for each password and stored in somewhat public location.
- The HASH tabled needed to brute force a username and password will have 100 hashed entries in it – logic – every acceptable password word times every listed SALT (of which there will be 10 – one for each password).
So the computational effort required to make a hash table to brute force a password when passwords are SALTED is exponentially harder the larger the dictionary of valid brute force passwords – and this is for a known SALT scenario.
Considerations..
- A hacker could JUST pick one user only from a user DB and this negates the SALT as for one user the HASED output based on the same dictionary input will be the same. But the hacker should hope that the users password is listed in the dictionary input table and not very complex – i.e. it has to be guessable in some fashion.
- The hacker one the other hand could take the WHOLE user DB, maybe 100 users as there is most likely at least one person there that has a lame password which will fall inside the input dictionary though the computational work to create the hashed table and then check against the password database is extreme in comparison. |
Thanks!
|
Dev Shed Forums Sponsor:
Del.icio.us
Digg
Google
Spurl
Blink
Furl
Simpy
Y! MyWeb
Linear Mode
