Re^3: how to crypt and decrypt password from 4 to 15 characters in length

Note that recent advances against hashing affect _collision resistance_, i.e., make it feasible to generate identical hashes from different inputs. These kinds of weaknesses don't directly influence the security of password one-wayness. (They don't let one create a password with the same hash as any particular other one.)

Comment on Re^3: how to crypt and decrypt password from 4 to 15 characters in length

Replies are listed 'Best First'.
Re^4: how to crypt and decrypt password from 4 to 15 characters in length by tirwhan (Abbot) on Jan 21, 2006 at 19:16 UTC
True, which is why I said there is no need to migrate existing applications at this point. However, the existence of collision attacks makes it more likely that preimage attacks (which would allow to generate an input that will produce a given existing hash) will be found. More secure algorithms exist and are not prohibitively computationally expensive, no reason not to use them. There are ten types of people: those that understand binary and those that don't.	[reply] [d/l]

Replies are listed 'Best First'.

Re^4: how to crypt and decrypt password from 4 to 15 characters in length
by tirwhan (Abbot) on Jan 21, 2006 at 19:16 UTC

True, which is why I said there is no need to migrate existing applications at this point. However, the existence of collision attacks makes it more likely that preimage attacks (which would allow to generate an input that will produce a given existing hash) will be found. More secure algorithms exist and are not prohibitively computationally expensive, no reason not to use them.

There are ten types of people: those that understand binary and those that don't.

[reply]
[d/l]