Re: Determining the encryption used

[Tim <tim-pentest () sentinelchicken org>]

I don't mean to take it off-topic, but I couldn't resist a few
comments... 

> However, most applications have a default preference. That is, nowadays
> most programs are somewhat AES-192-phile even though noone would
> actually recommend the use of AES (I hope).

What makes you say that?  What is wrong with AES?


> However, passwords or whatever stored in a database are not encrypted
> with a symmetric cipher most of the time (Except for DES "encoded"
> passwords). In this area you can usually tell the hash by the length of
> the stored data (but you can't correlate it to the length of the
> original input):
>
> 7 bytes / 56 bit -> DES

I believe the block size for DES is 64 bits, yes?  Sure, the key is 56
(or 64 bits with an 8-bit checksum), but the block is different.


> BTW, if you're free to choose a hash function for your program, don't
> use DES, MD5 or SHA1. DES isn't worth anything more than EBCDIC these
> days, MD5 has 8 bit of security margin left (so if you attack it, you
> need to bruteforce 256 possibilities to find a collision - not really
> hard to do), and SHA1 isn't that much safer anymore either. SHA2 isn't
> really good at that, but at least it didn't fall apart that much yet.

For the purpose of a one-way function, neither MD5 nor SHA1 has been
broken.  AFAIK, they are only vulnerable to collision attacks, not first
preimage or second preimage attacks, which rely on different properties.
Using these functions for specific purposes (such as hashing passwords)
is perfectly fine right now.


> Call to everyone: we need a new decent hash function!

Yes, we do, but not in the context you describe.

tim

------------------------------------------------------------------------------
This List Sponsored by: Cenzic

Concerned about Web Application Security? 
Why not go with the #1 solution - Cenzic, the only one to win the Analyst's 
Choice Award from eWeek. As attacks through web applications continue to rise, 
you need to proactively protect your applications from hackers. Cenzic has the 
most comprehensive solutions to meet your application security penetration 
testing and vulnerability management needs. You have an option to go with a 
managed service (Cenzic ClickToSecure) or an enterprise software 
(Cenzic Hailstorm). Download FREE whitepaper on how a managed service can 
help you: http://www.cenzic.com/news_events/wpappsec.php 
And, now for a limited time we can do a FREE audit for you to confirm your 
results from other product. Contact us at request () cenzic com for details.
------------------------------------------------------------------------------