Re: Importance of salt

vla10d_at_gmail.com
Date: 09/16/05 

Date: 16 Sep 2005 00:53:25 -0700

Precomputed tables... now this really sheds some light. :) I didn't
think about the hashed dictionaries. Okay, I see now how any kind of
salting helps against that kind of dictionaries. On the other hand, if
the attacker uses plain dictionaries and computes the hash at runtime
(with my salt), then I can use high number of iterations to slow him
down a bit. Thanks for the explanation... :)

As for your suggestions... this means that the attacker will first have
to try to decrypt a key by lets say dictionary attack, and for each
attempt (each retrieved key) he has to try to decrypt the entire
message with that key. I'm not sure that this is dramatically better
than the original situation where the attacker tries to generate a key
and use that key to decrypt the message. The only advantage that I see
is that in your case, he will spend a bit more time, since he has to
decypt twice. At least thats my understanding, please correct me if i'm
wrong... :)

V.

Relevant Pages

  • RE: Password strength
    ... Then you increase your password to 2 letters - ... an all lowercase password like "thisisalongpassword" would be 26^19 = ... attacker already knows that you only use lower case letters. ... dictionaries freely available for download. ...
    (Security-Basics)
  • Re: Importance of salt
    ... yes - again that slows him down - and give the number of computations necessary ... > salting helps against that kind of dictionaries. ... > the attacker uses plain dictionaries and computes the hash at runtime ... > each attempt he has to try to decrypt the entire ...
    (microsoft.public.dotnet.security)