full-disclosure - Re: Month of Random Hashes: DAY THREE

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Fri, 15 Jun 2007 16:59:01 -0300
From: M.B.Jr. <marcio.barbado@...il.com>
To: full-disclosure@...ts.grok.org.uk
Subject: Re: Month of Random Hashes: DAY THREE

damn man,
you complicate it so much.

right now,
Deepan is more confused than before.
like,
"Hey Deepan, in order to kill that mosquito we have this missile and..."

Math is simple,
and so must be the explanations surrounding it.

the thing is,
many different strings can result in the same, say md5 hash signature.

but only one string can produce that md5 hash signature,
that sha1 hash signature, fucking that sha256 hash signature, fucking that
<any_other> hash signature, etc...

On 6/14/07, Brian Dessent <brian@...sent.net> wrote:
>
> Dëêþàñ Çhäkrãvârthÿ wrote:
> >
> > I am not sure what  exactly people do with random hashes.  Do you people
> > try to decrypt using rainbow table or anything similar to that ?
> > Guys I am in the dark, please help me.
>
> The original intent was that someone discovering a vuln would post the
> hash of the POC to the list so that later when it was widely released
> they could prove the point in time at which they found it.
>
> Hashing is not encryption, so flush the notion of "decrypt a hash" from
> your brain.  For any given hash there are an infinite number of inputs
> that would result in that same output, though most of them are
> meaningless strings of garbage of astronomical length.  In the case of
> passwords since it is known that they are typically short in length and
> have a limited set of characters it's sometimes possible to come up with
> an input that is sensible, but for something like a POC of a
> vulnerability it would be quite naive to think that you could ever
> recover it in any reasonable amount of time.  That was never the intent
> anyway; it was about proving who was first to discover something.
>
> But seeing as this is FD and there has been a rash of "Month of Foo"
> nonsense, I think someone is just taking the piss and further degrading
> the already miniscule SNR of this list.  Unless a posted hash is
> correlated to the release of some POC or other item of interest, it's
> noise.
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>

-- 
Marcio Barbado, Jr.
==============
==============

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/