lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
Hash Suite for Android: free password hash cracker in your pocket
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Sat, 14 Mar 2015 08:07:54 +0800
From: Ben Harris <>
Subject: Re: [PHC] Password hashing by itself is not enough

On 14/03/2015 3:57 am, "Gregory Maxwell" <> wrote:
> This provides _very_ narrow security, unless you put the master key
> decryption function (and ideally, comparison) inside a HSM (hardware
> security module) which acts as a rate limiter for checking; since most
> attacks that would allow the attacker to get the database also allow
> them to get the master key.

Do you have any examples to back this up? By my reasoning, there are
relatively few attacks that would disclose both as the database is usually
on a different box, with access from different roles and backups are stored
in different areas.

Plus, most attacks large enough to disclose both parts could also just
result in the attacker sniffing the plaintext passwords from the servers
responsible for hashing it.

I'm not saying it is a silver bullet, just disagreeing that 'most' attacks
would compromise both.

Content of type "text/html" skipped

Powered by blists - more mailing lists