Re: Hashed password secure?

From: Tom St Denis (tom_at_securescience.net)
Date: 06/29/04 

Date: Tue, 29 Jun 2004 21:56:17 GMT

Matthijs Hebly wrote:

> Bill Unruh schreef:
>>
>> ]Correction: my suggestyion would run it
>> ]*Random(SomeNumberDependentOnCPUSpeed)* times. Which, IMHO, makes it
>> ](almost) impossible for some attacker to create a dictionary of hashes
>>
>> It also makes it completely non-portable. And has the danger that when
>> you replace your machine, suddenly no password, including root's, works.
> I don't see how this is in any way platform dependent...
> Why is hashing in itself platform *in*dependent, but hashing a random
> number of times, or with a random salt suddenly platform *dependent*?!?
> Plz explane.

...SomeNumberDependentOnCPUSpeed

Presumably my Barton 3200+ and my P4 2.8C have different values of
"cpuspeed". That makes it non-portable.
 
>> Bad idea.
> Thanx. I'll implement it anyway, and let you know how it works...

You do that. Nobody will use your software so in the grand scheme of things
it makes no difference anyways.

Tom

Relevant Pages

  • Re: VBA and VSTO
    ... so I am not dependent to what the user have installed of ... Is my code in VBA in a high level portable to the new ...
    (microsoft.public.excel.programming)
  • Re: Cross Platform Development
    ... On GNU/Linux, applications can and do ... widely-used languages on the platform. ... Would you really be happy to be completely dependent ... If the problem is that you want to write closed-source code, ...
    (uk.comp.os.linux)
  • Re: CETK - Rebuilding the Touch Screen test in Kernel mode
    ... **Am launcing the touchtest from CETK where we have changed the ... so in the blogs it was written that to run the touchtest in kernel ... PB Debugger Loaded symbols for 'C:\PROGRAM FILES\MICROSOFT PLATFORM ... dependent module could not be found. ...
    (microsoft.public.windowsce.platbuilder)
  • How many active Threads is possible?
    ... not a language question: ... How many active threads can I create? ... Of course, it is dependent on the platform and the VM implementation, ...
    (comp.lang.java.programmer)
  • Re: Hashed password secure?
    ... ]>]impossible for some attacker to create a dictionary of hashes ... ]I don't see how this is in any way platform dependent... ... ]Why is hashing in itself platform *in*dependent, ...
    (sci.crypt)