Beefy Boxes and Bandwidth Generously Provided by pair Networks
go ahead... be a heretic
 
PerlMonks  

Re^3: Digest::MD5 variation problem?

by zork42 (Monk)
on Aug 24, 2013 at 03:49 UTC ( #1050755=note: print w/replies, xml ) Need Help??


in reply to Re^2: Digest::MD5 variation problem?
in thread Digest::MD5 variation problem?

i tried to make it really well md5īd ;)
  1. I think 1 application of MD5 would do the job as I don't think MD5 hashes can be reversed at present. ie MD5 has not been cracked yet apart from "collision" attacks.
    However there are much more secure hashes like SHA-2.
    See http://en.wikipedia.org/wiki/MD5#Security, and http://en.wikipedia.org/wiki/SHA-2

  2. There are reasons why you might want to do a very large number of repeated invocations of a hash function. This is called Key stretching (see "(A)" below)
    However, "very large" is a lot more than 3 ;). Maybe 1,000s or much, much more.
    eg maybe see how many invocations you can do in 0.1 sec or 1 sec on the target system, and use that number of hash invocations.
    Adjust bcrypt cost to prevent future password hash attacks proposes a method which will keep password hashes strong, even as CPU speeds increase.

  3. Also, you should ideally use a large salt that is different for each user. (see "(B)" below)

From http://en.wikipedia.org/wiki/Cryptographic_hash_function#Password_verification:
Password verification

A related application is password verification. Storing all user passwords as cleartext can result in a massive security breach if the password file is compromised. One way to reduce this danger is to only store the hash digest of each password. To authenticate a user, the password presented by the user is hashed and compared with the stored hash. (Note that this approach prevents the original passwords from being retrieved if forgotten or lost, and they have to be replaced with new ones.) The password is often concatenated with a random, non-secret salt value before the hash function is applied. The salt is stored with the password hash. (B) Because users have different salts, it is not feasible to store tables of precomputed hash values for common passwords. (A) Key stretching functions, such as PBKDF2, Bcrypt or Scrypt, typically use repeated invocations of a cryptographic hash to increase the time required to perform brute force attacks on stored password digests.

Main article: http://en.wikipedia.org/wiki/Password_cracking

I hope this is of interest! :)

Replies are listed 'Best First'.
Re^4: Digest::MD5 variation problem?
by AlexTape (Monk) on Sep 04, 2013 at 11:15 UTC
    nice! thanks!
    $perlig =~ s/pec/cep/g if 'errors expected';

Log In?
Username:
Password:

What's my password?
Create A New User
Node Status?
node history
Node Type: note [id://1050755]
help
Chatterbox?
[1nickt]: not all all yet
[1nickt]: the stable subversion of each major version on the platform I have in my hands most of the day
[Tux]: choroba can't you up the default stack size to 17?
[1nickt]: and I will maybe add the other subversions
[1nickt]: I am on MacOSX and there is a sore lack of testing resources for CPANTS I think
[choroba]: Tux Why? It works for me with 16 :-)
[Tux]: and the defailt is 15?
[choroba]: sorry, typo. Works for me with 15 which is the default
[choroba]: Timestamps should work correctly now

How do I use this? | Other CB clients
Other Users?
Others avoiding work at the Monastery: (9)
As of 2017-09-19 20:12 GMT
Sections?
Information?
Find Nodes?
Leftovers?
    Voting Booth?
    During the recent solar eclipse, I:









    Results (228 votes). Check out past polls.

    Notices?