storing passwords

Newsgroups	sci.crypt
Subject	storing passwords
From	"David Eather" <eather@tpg.com.au>
Message-ID	<op.x6gohjykwei6gd@phenom-pc> (permalink)
Date	2015-10-14 06:28 +1000

Show all headers | View raw

I have a project where I would like to store a relatively large number of  
passwords in a relatively small space. I came up with this and just want  
some other eyes to spot the obvious flaw that I can't see.

(assuming the actual storage device is tamper proof and cannot be hacked -  
ok that one flaw but lets over look that)

I have a salt and a large secret password (hard-coded into the tamper  
proof design) such that the length of the salt and password makes  
inverting a hash function practically impossible. To that I append a short  
counter and the combined salt & long password & counter is hashed to give  
a user password.

(just re-reading that I don't need a salt I can just use a longer secret  
password)

If I have 2**n  - 1 passwords is it still impossible to guess or derive  
the missing password? (I think yes)

Other than such tamper proof hardware not existing and not being able to  
choose your own passwords is there some other flaw I have missed?

Back to sci.crypt | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

storing passwords "David Eather" <eather@tpg.com.au> - 2015-10-14 06:28 +1000
  Re: storing passwords Jakob Bohm <jb-usenet@wisemo.com> - 2015-10-13 23:06 +0200
    Re: storing passwords "David Eather" <eather@tpg.com.au> - 2015-10-15 08:45 +1000
  Re: storing passwords Paul Rubin <no.email@nospam.invalid> - 2015-10-13 14:22 -0700
    Re: storing passwords Jakob Bohm <jb-usenet@wisemo.com> - 2015-10-13 23:42 +0200
      Re: storing passwords Paul Rubin <no.email@nospam.invalid> - 2015-10-13 14:48 -0700
        Re: storing passwords Jakob Bohm <jb-usenet@wisemo.com> - 2015-10-14 00:09 +0200
          Re: storing passwords <william@wilbur.25thandClement.com> - 2015-10-16 18:08 -0700
            Re: storing passwords Jakob Bohm <jb-usenet@wisemo.com> - 2015-10-19 15:51 +0200
  Re: storing passwords "David Eather" <eather@tpg.com.au> - 2015-10-15 08:45 +1000
  Re: storing passwords Jeffrey Goldberg <nobody@goldmark.org> - 2015-10-15 15:51 -0500

csiph-web