RE: Values to use for a salt?

From: Michael Wojcik (Michael.Wojcik_at_microfocus.com)
Date: 12/17/03

  • Next message: Eric Knight: "Re: Values to use for a salt?" 
    To: secprog@securityfocus.com
Date: Wed, 17 Dec 2003 09:58:18 -0800

    > From: Marian Ion [mailto:marian.ion@e-licitatie.ro]
    > Sent: Wednesday, December 17, 2003 4:01 AM
     
    > Don't you think using extendedASCII set will dramatically increase the
    > performance of any algorithm currently in use? Imagine what a
    > pass like "|¤W-|[V.|1D-|`â-|Ë3-|%-|F0-| " means for a cracker: ...

    Enlarging the password alphabet has the same effect as lengthening the
    password. The larger the domain of possible passwords, the more space an
    attacker has to search. That's a basic characteristic of passwords which
    should be familiar to anyone working with password-based authentication.

    > Will you still need salt and others?

    That depends on your threat model and the strength of the passwords you're
    protecting. Even if your system allows strong passwords, users may use weak
    ones if they're allowed to do so. If your threat model includes defending
    against an attacker who has resources to precompute a dictionary that
    includes the weakest passwords permitted by your system, then adding salt
    would be a way to address that threat. 

    -- 
Michael Wojcik
Principal Software Systems Developer, Micro Focus
  • Next message: Eric Knight: "Re: Values to use for a salt?"

    Relevant Pages

    • Re: Password Management (Not user a/c)
      ... ](and this gives the security team nightmares). ... and the response should take into account how people actualy ... passwords monthly and make the passwords incomprehesible lists of characters, ... if wallet theft is not a reasonable threat model. ...
      (comp.security.unix)
    • Re: Force users to change their password every 30 days?
      ... write down their passwords and defeat the intended purpose. ... That depends entirely on the threat model. ... No it is not pointless. ... forced monthly password changes was one of the worst ...
      (comp.os.linux.misc)
    • Re: Force users to change their password every 30 days?
      ... write down their passwords and defeat the intended purpose. ... That depends entirely on the threat model. ... No it is not pointless. ... The attack model may make that worthwhile, ...
      (comp.os.linux.misc)
    • Re: Force users to change their password every 30 days?
      ... write down their passwords and defeat the intended purpose. ... That depends entirely on the threat model. ... No it is not pointless. ... change scripts of the form: ...
      (comp.os.linux.misc)
    • Re: Paper & pencil password algorithm
      ... capable attacker. ... gathered large numbers of passwords through spyware. ... I think the phishers try to magnify the accounts they've stolen ...
      (sci.crypt)