phc-discussions - Re: [PHC] Second factor (was A review per day

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CA+hr98HANxtwCniwAYUk62K1huj4V367=jw4Cm=A3DOr8kz=0w@mail.gmail.com>
Date: Wed, 3 Sep 2014 13:16:37 +0200
From: Krisztián Pintér <pinterkr@...il.com>
To: "discussions@...sword-hashing.net" <discussions@...sword-hashing.net>
Subject: Re: [PHC] Second factor (was A review per day - Schvrch)

On Wed, Sep 3, 2014 at 12:43 PM, Bill Cox <waywardgeek@...hershed.org> wrote:
> Second factor is something that I think a lot of entries with a secret
> key or local parameter or data field.

adding 128 bit or 256 bit secret key is easy. adding megabytes of
secret data is not that easy. i can add up to m_cost words of secret
data, and the derived key is pseudorandom on every single bit of it.
it is also not possible to compress the secret data, you really need
all of it.

that said, i don't think that it is a very important feature, i added
anyway because with my algorithm, it is almost free, has negligible
cons, so why the hell not? i have the same reason for the Transform
function. it helps not much, but it also costs near zero. i wouldn't
be surprised if nobody ever used these features.