Poul-Henning Kamp: LinkedIn Password Leak? Salt Their Hide

Post by xtracto » Fri, Jun 08, 2012, 7:56 PM UTC

phkamp wrote: post #30

capsule_toy wrote: post #26

Earlier quoted context omitted.

LinkedIn was launched, in what, 2003? If you googled the general advice back then, it was pretty much just use MD5 or, if you were really cutting edge, SHA1. Salting wasn't common at all. Salting eventually started becoming common and now you're silly if you don't use bcrypt.

This is more a reflection on where you got your advise in 2003, than what was considered best-practice. Salting became best-practice in the 1980ies, but the "lost generation" of dot-com wizards never bothered reading "all that old stuff", so they are doomed to repeat the mistakes.

I remember reading about salting back in the 90´s when I got my first copy of FreeBSD. It definitely is an old concept

Post by Robin_Message » Wed, Jun 13, 2012, 12:15 PM UTC

darklajid wrote: post #58

Robin_Message wrote: post #43

Earlier quoted context omitted.

Re the gut feeling – this is only a problem if the password has significantly more entropy than the hash. So, worst case MD5 (128 bits), this is potentially bad for people with printable ASCII (97 chars) longer than 19 characters. But it's still not a real problem since 128 bits of entropy is unguessable in the lifetime of the universe (checking 2^64 hashes a second, which is obscenely many – perhaps every processor…

Thanks for the answer. I can safely say that I'm far from an expert on the subject. If you'd be willing to educate me a tiny bit more though : Is the first case (judging normal passwords) factoring in that a password varies in length? I mean, stupid thought again: You need to test all one character passwords, all two character password, a hash is fixed in its length? And I wouldn't want to find the original input, I'…

Sorry, I missed this, but hopefully you will see it.

A hash is fixed, but at a long length. Now, because of geometric growth, the shorter lengths are basically irrelevant (since there are 10s times more 19 character passwords than 18 character ones, 100s or 1000s times more 19 than 17, and so on)

On the second point, yes, exactly, you need a word list of all hexadecimal strings of length x. Again, in the case of MD5 (128 bits), this is all the 32 character hexadecimal strings (since 32 characters * 4 bits per hexadecimal character is 128 bits). Such a list has a length of 2 to the power of 128 by definition - 340282366920938463463374607431768211456 items (about 10^38).

Making a list 10^38 items long is not impossible since that's well below the number of atoms in the earth (about 10^50). It is probably impractical however. Suppose you could store the numbers in iron (the most abundant element), you'd need to store each item of the list in about 0.01 nanograms.

Re: Poul-Henning Kamp: LinkedIn Password Leak? Salt Their Hide

Re: Poul-Henning Kamp: LinkedIn Password Leak? Salt Their Hide