lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
 
Hash Suite for Android: free password hash cracker in your pocket
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 6 May 2014 13:38:02 +0100
From: Peter Maxwell <peter@...icient.co.uk>
To: "discussions@...sword-hashing.net" <discussions@...sword-hashing.net>
Subject: Re: [PHC] Hashing password while typing

On 6 May 2014 12:53, Bill Cox <waywardgeek@...il.com> wrote:

> Here's a dumb idea for reducing the pain associated with long password
> hashing runtimes.  Simply hash the password while the user is typing it.
>  I'm sure it's an old idea, but I haven't heard it before, so just in case,
> I thought I'd post it here before someone patents it.
>
> There are a ton of issues, which I haven't figured out.  An attacker would
> likely guess a prefix, and then try a lot of suffixes, before moving to the
> next prefix, making all that pre-computation close to worthless.  However,
> the time between typing the last character in his password and hitting
> Enter is time well used for hashing.  Also, the hashing time spent on the
> password before the last character aren't completely wasted.  One way to
> look at them is as a generator for an in-memory ROM.
>
>
I suspect the problem is two fold:

- Nobody types at a constant rate.  So even if the hash function is
constant time, the attacker will see a spike in system activity on each
key-press, which then can be worked backwards to the password. For example,
I tend to type quicker with the letters on the qwery and asdfg rows, but
slow slightly when needing to pull my fingers backwards to hit zxcv.

- What happens when a user isn't quite sure of their password and
repeatedly types-deletes characters?  (would your computation need to start
again, would it need to be invertible, etc)

Content of type "text/html" skipped

Powered by blists - more mailing lists