Ian Bicking wrote: > On Sun, 2003-02-23 at 11:10, Randall Randall wrote: > >>Uh, I'm not a cryptographer either, so at the risk of sourding uninformed, >>what's wrong with a two line script like: >> >>import sha >>passwd = 'testing' >>passwd_hash = sha.new(passwd).hexdigest() >> >>Is your version much more secure than straight SHA1? > > > Using a salt makes a dictionary-based attack harder. You can, ahead of > time, create SHA1 hashes of all the words in the dictionary (or a > dictionary of likely passwords), and then compare those against the hash > when you get the chance. By introducing a random prefix (salt) you > force the attacker to do more work when trying a dictionary attack. > > For passwords associated with usernames (which isn't the case here) you > can usually derive the salt (the prefix) from the username itself. Then > the attacker has hash all the passwords in their dictionary for each > user, as opposed to doing it once for all users on a system.
Thank you Stuart, Michael, and Ian for correcting my ignorance. :) I had assumed that dictionary attacks just had to be lived with. -- Randall Randall <[EMAIL PROTECTED]> 'Institute regime change everywhere... to "None of the above."' -- Alex Future Bokov ------------------------------------------------------- This SF.net email is sponsored by: SlickEdit Inc. Develop an edge. The most comprehensive and flexible code editor you can use. Code faster. C/C++, C#, Java, HTML, XML, many more. FREE 30-Day Trial. www.slickedit.com/sourceforge _______________________________________________ Webware-discuss mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/webware-discuss
