Re: Apache web server 2.2: htpasswd predictable salt weakness

Dear Peter Watkins,

--Thursday, February 14, 2008, 5:55:17 AM, you wrote to bugtraq@xxxxxxxxxxxxxxxxx:


PW> As a result:
PW> - Salts created by htpasswd are very predictable.
PW> - The universe of salts for htpasswd is far less than the MD5 algorithm
PW> provides for -- 29 bits vs. 48, or 0.000191 percent of the range that
PW> should be used for MD5.

As far as I understand, salt predictability gives nothing to you. Salt
protects against rainbow tables attacks in case stored passwords are
stolen. Salt is stored with password, that is salt is known to attacker.
All you need for salt is to be different for different passwords and for
different systems. That is 175, 176, 177 etc are pretty good salts for
sequentially generated passwords in case 175 is apriory unknown.

Salt universe is more important, but 29 bits against 48 is not something
scaring.

May be I am missing something?

--
~/ZARAZA http://securityvulns.com/

Relevant Pages

  • MD5 password salt calculation
    ... Is there an accepted/standard method of calculating the cryptsalt ... for *new* passwords with MD5? ...
    (FreeBSD-Security)
  • Re: Importance of salt
    ... About passwords in cryptography - there are tons of resources, ... Passwords and Offline Guessing Attacks. ... > I have one question regarding the importance of salt in encryption. ... the salt is used to prevent dictionary attacks. ...
    (microsoft.public.dotnet.security)
  • Re: Authenticate a User.
    ... > contain crypted passwords. ... >> That is because the salt may be longer than 2 characters. ... This is true if you're using the MD5 version of crypt, ... then a longer salt is obviously a possible explanation. ...
    (comp.os.linux.development.apps)
  • Re: Encrypt a UsernameToken Authenticated WSE Response
    ... add another word, case sensitivity, or a number, ... and most people cant manage their passwords. ... >> you can also make is stronger by prepending SALT. ... > That is because normally salt is sent to the client in clear text so it is ...
    (microsoft.public.dotnet.framework.webservices.enhancements)
  • Re: Importance of salt
    ... Dominick Baier - DevelopMentor ... > About passwords in cryptography - there are tons of resources, ... >> I have one question regarding the importance of salt in encryption. ... the salt is used to prevent dictionary attacks. ...
    (microsoft.public.dotnet.security)