On Mon, 2 Sep 2013 09:44:27 +0100, Costin Enache wrote: >The password phrase hash can be split into blocks of 8 bytes, and each of >them "cracked" independently, also in parallel. > Sounds like a half-hearted implementation -- what would have been the additional cost of using larger blocks?
>Another flaw, concerning the hash storage, allows for collisions in the last >block, >if the phrase length is not exactly multiple of 8. > The obvious question, then, is would the method be improved simply by padding that last block (with blanks, e.g.; or better characters invalid in the passphrase) to a multiple of 8. Does the passphrase syntax permit trailing blanks so that passphrases differing only in the number of trailing blanks are considered different? Does the method still operate by storing the user ID encrypted by the (chunks of) the passphrase? Is any weakness introduced by the 7-character (practical) limitation of user IDs? -- gil ---------------------------------------------------------------------- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
