lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Wed, 10 Sep 2014 22:57:35 -0700 From: Andy Lutomirski <luto@...capital.net> To: discussions <discussions@...sword-hashing.net> Subject: Re: [PHC] Makwa is broken given p and q On Wed, Sep 10, 2014 at 8:55 PM, Steve Thomas <steve@...tu.com> wrote: > Given p and q you can do: > e = 2 ** cost > e' = 2 ** cost (mod (p-1)*(q-1)) > x ** e = x ** e' (mod p*q) This is described (in the CRT formulation) in the Makwa paper. > > > You could pick the cost to be 2 ** 128. Without p and q you can't test a > password. > powConst = powm(2, pow(2, 128), (p-1)*(q-1)) > hash = powm(password, powConst, p*q) > but you could just do HMAC(password, secretKey) > > Sorry but even if you came up with the perfect server-specific shortcut, HMAC or > encryption with a secret key is better. > > If you don't know the secret, it takes 3x longer. > vs > If you don't know the secret, you can't do anything. Huh? I don't think that anyone is proposing using Makwa with cost 2^128. --Andy
Powered by blists - more mailing lists