Security Basics mailing list archives
Re: Hashing passwords
From: Rory Browne <rbmlist () gmail com>
Date: Mon, 11 Jun 2012 19:32:03 +0100
I think the issue here, is that if my password is 'asdf' ( it isn't ), then the sha1 hash will be '3da541559918a808c2402bba5012f6c60b27661c'. This means that someone can create a table mapping '3da541559918a808c2402bba5012f6c60b27661c' to 'asdf'. This kind of table is called a rainbow table. I don't think it's of much benefit hashing more than once. If that was the standard practice, then an attacker instead would map '30a518b67dcd7af15b369ccb1518ab3cad8e8b2c' ( 'asdf' sha1-hashed twice ) to 'asdf'. I imagine including the username and org in the hash would improve the situation ( in which case, you would hash a concatenation of the username, password, and org ). Does anyone know of any security problem, where instead of salting with a random number ( which IIUC would need to be stored as well ), the hash was salted with the username and the org. That way, two different users with the same password would have different hashes, and the hashes would also be different from any other system. Rory On 11 June 2012 18:55, Ansgar Wiechers <bugtraq () planetcobalt net> wrote:
On 2012-06-11 haZard0us wrote:This may well be a silly question but, with this recent hashed password leakage, I want to ask something about properly hashing. The "manuals" say that we should create a salt and then hash it. But, since calculating an hash is a "relative simple" operation (in matter of processing power), is hashing two or three times the password (hash over hash) a "kind of" secure method or it is as weak as not using salt at all? It can still be cracked but...Yes, it can still be cracked. However, salting passwords defeats the advantages gained from using rainbow tables, so cracking the password will still take a significantly longer time than it would for an unsalted password. Regards Ansgar Wiechers -- "All vulnerabilities deserve a public fear period prior to patches becoming available." --Jason Coombs on Bugtraq ------------------------------------------------------------------------ Securing Apache Web Server with thawte Digital Certificate In this guide we examine the importance of Apache-SSL and who needs an SSL certificate. We look at how SSL works, how it benefits your company and how your customers can tell if a site is secure. You will find out how to test, purchase, install and use a thawte Digital Certificate on your Apache web server. Throughout, best practices for set-up are highlighted to help you ensure efficient ongoing management of your encryption keys and digital certificates. http://www.dinclinx.com/Redirect.aspx?36;4175;25;1371;0;5;946;e13b6be442f727d1 ------------------------------------------------------------------------
------------------------------------------------------------------------ Securing Apache Web Server with thawte Digital Certificate In this guide we examine the importance of Apache-SSL and who needs an SSL certificate. We look at how SSL works, how it benefits your company and how your customers can tell if a site is secure. You will find out how to test, purchase, install and use a thawte Digital Certificate on your Apache web server. Throughout, best practices for set-up are highlighted to help you ensure efficient ongoing management of your encryption keys and digital certificates. http://www.dinclinx.com/Redirect.aspx?36;4175;25;1371;0;5;946;e13b6be442f727d1 ------------------------------------------------------------------------
Current thread:
- Hashing passwords haZard0us (Jun 11)
- Re: Hashing passwords Ansgar Wiechers (Jun 11)
- Re: Hashing passwords Rory Browne (Jun 11)
- RE: Hashing passwords Liam Randall (Jun 12)
- Re: Hashing passwords martin . mngoma (Jun 12)
- Re: Hashing passwords Kai Wirt (Jun 12)
- Re: Hashing passwords Kurt Buff (Jun 12)
- Re: Hashing passwords Ansgar Wiechers (Jun 13)
- Re: Hashing passwords Kurt Buff (Jun 13)
- Re: Hashing passwords Alexander Klimov (Jun 13)
- Re: Hashing passwords Rory Browne (Jun 11)
- RE: Hashing passwords Mikhail A. Utin (Jun 13)
- Re: Hashing passwords Kai Wirt (Jun 13)
- Re: Hashing passwords Ansgar Wiechers (Jun 11)