On Sun, 2003-02-23 at 11:10, Randall Randall wrote: > Uh, I'm not a cryptographer either, so at the risk of sourding uninformed, > what's wrong with a two line script like: > > import sha > passwd = 'testing' > passwd_hash = sha.new(passwd).hexdigest() > > Is your version much more secure than straight SHA1?
Using a salt makes a dictionary-based attack harder. You can, ahead of time, create SHA1 hashes of all the words in the dictionary (or a dictionary of likely passwords), and then compare those against the hash when you get the chance. By introducing a random prefix (salt) you force the attacker to do more work when trying a dictionary attack. For passwords associated with usernames (which isn't the case here) you can usually derive the salt (the prefix) from the username itself. Then the attacker has hash all the passwords in their dictionary for each user, as opposed to doing it once for all users on a system. Ian ------------------------------------------------------- This SF.net email is sponsored by: SlickEdit Inc. Develop an edge. The most comprehensive and flexible code editor you can use. Code faster. C/C++, C#, Java, HTML, XML, many more. FREE 30-Day Trial. www.slickedit.com/sourceforge _______________________________________________ Webware-discuss mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/webware-discuss
