lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
 
Hash Suite for Android: free password hash cracker in your pocket
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Thu, 28 Mar 2013 03:24:17 +0000
From: Peter Gutmann <pgut001@...auckland.ac.nz>
To: "discussions@...sword-hashing.net" <discussions@...sword-hashing.net>
Subject: Re: [PHC] Re: Suggestion: API should include a verifier function

Watson Ladd <watsonbladd@...il.com> writes:

>This isn't necessary: a non-constant time comparison at worst reveals the
>hash, which doesn't give an attacker enough information to break a password
>anyway if we do our jobs right.

Oh yes it can ;-).  There's a clever attack that was presented at Kiwicon last
year that turns timing attacks on hashed passwords into partial attacks on the
original passwords.  It'll appear in the Crypto Corner column of IEEE Security
and Privacy in (AFAIK) the next issue.

Peter.

Powered by blists - more mailing lists