Hashed PW's more secure than encrypted PW's?

From: sakky (sakhalinrf@hotmail.com)
Date: 06/14/02 

From: "sakky" <sakhalinrf@hotmail.com>
Date: Fri, 14 Jun 2002 19:13:30 GMT

Hey Unix gurus, can somebody answer this?

I have read many times how the preferred way in most Unix flavors to keep
track of passwords is to keep hashes of those passwords. I have read lots
of things that have stated that this is more secure than merely encrypting
those passwords. Clearly this is more secure than just keeping the
clear-text passwords lying around.

Can anybody explain how is it that hashing is more secure than encrypting?
The books I've read have stated that the file with those encrypted passwords
can be decrypted, and I can only assume this would be done via a brute-force
attack to get the encryption key. For example, somebody somehow obtains
that file with the encrypted passwords and then just starts running
brute-force on it to decrypt it. Well, OK, but wouldn't you also be able to
do brute-force on hashed passwords as well? What I mean is that you might
try every single combination of a password (via brute force) and then hash
it with the algorithm (which is well-known) to see if the result you get is
equal to what is in the file with the hashed passwords.

 So it seems to me that hashing the passwords is no more secure than just
encrypting the passwords. In either case, it seems to me that the level of
security would boil down to, in the case of encryption, the length of the
key, and in the case of hashing, the length of the password. Yet all the
literature I have read has emphatically stated that hashing the passwords is
better than encrypting them. What am I missing here?

Relevant Pages

  • Re: Hashed PWs more secure than encrypted PWs?
    ... : encrypting the passwords. ... key, and in the case of hashing, the length of the password. ... : better than encrypting them. ...
    (comp.security.unix)
  • Re: Hashed PWs more secure than encrypted PWs?
    ... : encrypting the passwords. ... key, and in the case of hashing, the length of the password. ... : better than encrypting them. ...
    (comp.security.unix)
  • Re: how to hide oracle instance name within dbi code??
    ... See for example the way Mozilla stores passwords ... If the program is used non-interactively, encrypting ... putting them into configuration files still makes a lot of sense: ... That's the environment of the process itself. ...
    (perl.dbi.users)
  • Hashed PWs more secure than encrypted PWs?
    ... track of passwords is to keep hashes of those passwords. ... Clearly this is more secure than just keeping the ... Can anybody explain how is it that hashing is more secure than encrypting? ...
    (comp.security.unix)
  • Re: Are Active Directory passwords encrypted?
    ... Just want to verify that passwords are automatically encrypted in Active Directory and on the domain controllers. ... What happens when you connect to a file is you basically acquire a service ticket at the DC by encrypting a message from the DC with your hashed password. ... The DC verifies the encrypted answer and - if the password is correct - hands out a ticket for the file server service. ...
    (microsoft.public.windows.server.active_directory)