Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > sci.crypt > #32891

Re: storing passwords

Show all headers | View raw

On Wed, 14 Oct 2015 06:28:21 +1000, David Eather <eather@tpg.com.au> wrote:

> I have a project where I would like to store a relatively large number  
> of passwords in a relatively small space. I came up with this and just  
> want some other eyes to spot the obvious flaw that I can't see.
>
> (assuming the actual storage device is tamper proof and cannot be hacked  
> - ok that one flaw but lets over look that)
>
> I have a salt and a large secret password (hard-coded into the tamper  
> proof design) such that the length of the salt and password makes  
> inverting a hash function practically impossible. To that I append a  
> short counter and the combined salt & long password & counter is hashed  
> to give a user password.
>
> (just re-reading that I don't need a salt I can just use a longer secret  
> password)
>
> If I have 2**n  - 1 passwords is it still impossible to guess or derive  
> the missing password? (I think yes)
>
> Other than such tamper proof hardware not existing and not being able to  
> choose your own passwords is there some other flaw I have missed?

Thanks everyone!

Back to sci.crypt | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

storing passwords "David Eather" <eather@tpg.com.au> - 2015-10-14 06:28 +1000
  Re: storing passwords Jakob Bohm <jb-usenet@wisemo.com> - 2015-10-13 23:06 +0200
    Re: storing passwords "David Eather" <eather@tpg.com.au> - 2015-10-15 08:45 +1000
  Re: storing passwords Paul Rubin <no.email@nospam.invalid> - 2015-10-13 14:22 -0700
    Re: storing passwords Jakob Bohm <jb-usenet@wisemo.com> - 2015-10-13 23:42 +0200
      Re: storing passwords Paul Rubin <no.email@nospam.invalid> - 2015-10-13 14:48 -0700
        Re: storing passwords Jakob Bohm <jb-usenet@wisemo.com> - 2015-10-14 00:09 +0200
          Re: storing passwords <william@wilbur.25thandClement.com> - 2015-10-16 18:08 -0700
            Re: storing passwords Jakob Bohm <jb-usenet@wisemo.com> - 2015-10-19 15:51 +0200
  Re: storing passwords "David Eather" <eather@tpg.com.au> - 2015-10-15 08:45 +1000
  Re: storing passwords Jeffrey Goldberg <nobody@goldmark.org> - 2015-10-15 15:51 -0500

csiph-web