full-disclosure - Re: password hash

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Fri, 5 Oct 2007 09:56:47 -0600
From: "Mark Senior" <senatorfrog@...il.com>
To: full-disclosure@...ts.grok.org.uk
Subject: Re: password hash

If you can repeatedly re-hash the same password, that should reveal
whether there's a salt involved or not - if it's salted, the algorithm
should be picking a new salt every time the hash is generated, and the
hash will be different every time for the same password.

On 10/5/07, Valdis.Kletnieks wrote:
> On Thu, 04 Oct 2007 22:22:14 EDT, Brian Toovey said:
> > Does anyone know what kind of password hash this is?
> > 'password1' =
> > &c6;Ub&c3;&ab;&19;a&cf;&86;
>
> Hex format would be less likely to be mis-parsed.  I'm *guessing* you
> mean the hash is x'c65562c3 ab1961cf 86' - which is slightly odd, being
> 72 bits long.  A salted 64-bit hash, perhaps?  Or it might be some home-grown
> hash that somebody invented.
>
> If you know what 'password1' hashes to, it's time to do some differential
> cryptography and try hashing 'password2', 'password11', 'passwor111', and so
> on, to determine how many input characters the hash considers.  The next thing
> to try is hashing 'qassword1' (which has one bit different from 'password1')
> and seeing how many of the output bits change, which will tell you the relative
> strength of the hash.  A good hash will have about half the bits change on a
> one-bit difference (and continuing through q, r, s, t and so on won't reveal
> any pattern of *which* bits change), while a bad hash will fail to cause a bit
> cascade and only a few bits will be different in the output.
>
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>
>

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/