RE: Values to use for a salt?

From: Ton Geurts (geurts_at_vanveen.nl)
Date: 12/23/03 

To: "'secprog@securityfocus.com'" <secprog@securityfocus.com>
Date: Tue, 23 Dec 2003 09:01:45 +0100

> I think (and I'm aware that I might prove wrong) that salt is for weak
> algorithms and weak passwords, set by regular users, not by a security
> administrator. But I would not let regular users set their own passwords,
> and use them for years ...
>
> Regards,
> Marian

For a dictionary attack the algorithm is irrelevant: the outcome is
calculated in advance. An attacker has time. A week or two extra to build
the hashed dictionary won't really matter. And I am not even talking about
government intelligence agencies (CIA, FBI, GCHQ, Mossad) with their
$10,000,000 Cray supercomputers.

A salt is needed more with weak passwords than strong passwords because weak
passwords can be found with a normal dictionary attack. But even for strong
passwords there is a case for salting. But even when you run my default
password '$3qRˆEt!' (pretty strong, especially because of the EURO sign)
through the algorithm: salted is safer because you cannot precompute all
strong passwords and salts unless you own a couple of those Crays.

Ton Geurts

BtW, if anyone thinks that the above is my real password: I'm a blond and I
am male, but I am not that stupid! My real password is

Relevant Pages

  • Re: Hash MD5, Sha1 and Length
    ... These are standard cryptographic methods for protecting bulk passwords ... algorithm = new MD5CryptoServiceProvider; ... The salt prevents two people using the same password having the same ... hash and also stops an attacker pre-calculating hashes for commonly ...
    (microsoft.public.dotnet.languages.csharp)
  • Re: wonder what tools or test was used
    ... "An investigation of developer passwords revealed a number of weak passwords whose accounts have been locked in response," Schulze wrote. ... (Mostly in marketing, ... I did not expect to get most of HR, then entire board of directors, and most of management ...
    (Pen-Test)
  • Re: Virus running through our network
    ... >From the description of what the Symantec technician said it sounds like the ... infection relies on weak passwords and weak share permissions. ...
    (microsoft.public.win2000.security)
  • Re: Given this evidence, should I be worried that I may have been hacked
    ... hammered once or twice a day most days, with username failures. ... I have ssh set to deny root logins, ... *Always* change default passwords and *never* use weak passwords. ...
    (freebsd-questions)
  • Re: Password Auditing
    ... to identify weak passwords on my servers. ... for such a reporting script is easily written. ...
    (Pen-Test)