Re: SHA-1 vs. triple-DES for password encryption?

John Viega wrote:

>>> Additionally, even if there were no salt, then the attacker
>>> would have to see O(2^32) known password-hash pairs just to find a
>>> single collision.  That isn't a real-world scenario.
>>
>>
>> Surely that depends on the application?

O(2^32) is not unattainable, even my debugging (hence, not using assembler optimisations) version of OpenSSL can do 60k SHA-1s a second, which is less than a day for 2^32 hashes...

So, if its worth spending a day finding a collision, its perfectly real-world - and yeah, a smart cookie would use iteration to make that harder, but even so, it seems likely to stay in reach for a determined attacker - hence the dependency on the application - it has to be worth the effort of finding a collision (which, as already noted, is unlikely when the collision is in passwords, but, since we still don't know what the passwords are for, not to be ruled out).

Cheers,

Ben.

-- 
http://www.apache-ssl.org/ben.html       
http://www.thebunker.net/

"There is no limit to what a man can do or how far he can go if he
doesn't mind who gets the credit." - Robert Woodruff