Re: [Full-disclosure] password hash

["Mark Senior" <senatorfrog@xxxxxxxxx>]

If you can repeatedly re-hash the same password, that should reveal
whether there's a salt involved or not - if it's salted, the algorithm
should be picking a new salt every time the hash is generated, and the
hash will be different every time for the same password.

On 10/5/07, Valdis.Kletnieks wrote:
> On Thu, 04 Oct 2007 22:22:14 EDT, Brian Toovey said:
> > Does anyone know what kind of password hash this is?
> > 'password1' =
> > &c6;Ub&c3;&ab;&19;a&cf;&86;
>
> Hex format would be less likely to be mis-parsed.  I'm *guessing* you
> mean the hash is x'c65562c3 ab1961cf 86' - which is slightly odd, being
> 72 bits long.  A salted 64-bit hash, perhaps?  Or it might be some home-grown
> hash that somebody invented.
>
> If you know what 'password1' hashes to, it's time to do some differential
> cryptography and try hashing 'password2', 'password11', 'passwor111', and so
> on, to determine how many input characters the hash considers.  The next thing
> to try is hashing 'qassword1' (which has one bit different from 'password1')
> and seeing how many of the output bits change, which will tell you the 
> relative
> strength of the hash.  A good hash will have about half the bits change on a
> one-bit difference (and continuing through q, r, s, t and so on won't reveal
> any pattern of *which* bits change), while a bad hash will fail to cause a bit
> cascade and only a few bits will be different in the output.
>
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>
>

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/