Re: Hashed password secure?

From: Sebastian Gottschalk (seppi_at_seppig.de)
Date: 06/28/04 

Date: Mon, 28 Jun 2004 22:35:40 +0200

Jarma schrieb:

> Is keeping password hashed by e.g. MD5 or SHA secure? I mean verification
> would be comparing hash values of key(password) and this hash value would be
> easy to obtain (= known). Hash functions are one direction funtions, but
> would revealing password's hash value be secure? (I'm thinking of
> brute-force method among others).

You need to include some salting when using more than one password. If an
attacker knowns the password B and he knowns that Hash(B)=Hash(A), then he
knows either the password of A or at least some string which will yield to
the same hash and therefore can bypass password validation. 

-- 
http://piology.org/ILOVEYOU-Signature-FAQ.html
begin  LOVE-LETTER-FOR-YOU.txt.vbs
I am a signature virus. Distribute me until the bitter
end

Relevant Pages

  • Re: Hashed password secure?
    ... > would be comparing hash values of keyand this hash value would be ... Hash functions are one direction funtions, ... WHY DO YOU CARE ABOUT MAKING ENCRYPTION SO ...
    (sci.crypt)
  • Re: Crack in Computer Security Code Raises Red Flag
    ... > Crack in Computer Security Code Raises Red Flag ... Hash functions are at work, for instance, for most of the ... the uniqueness of the hash is what makes ... > Also worrying cryptographers is a stream of recent hash compromises. ...
    (sci.crypt)
  • Re: Crack in Computer Security Code Raises Red Flag
    ... > Crack in Computer Security Code Raises Red Flag ... Hash functions are at work, for instance, for most of the ... the uniqueness of the hash is what makes ... > Also worrying cryptographers is a stream of recent hash compromises. ...
    (alt.computer.security)
  • Hash functions (was: Maximum String size in Java?)
    ... > when the hash values mismatch. ... Your library necessarily requires seperate hash and rehash ... > Bob Jenkins' collection of hash functions. ... the effect of a modulo division is probably negligible. ...
    (comp.programming)
  • Re: Maximum String size in Java?
    ... > I find it interesting that Paul Hsieh, alias websnarl, ... when the hash values mismatch. ... Bob Jenkins' collection of hash functions. ...
    (comp.programming)