-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi Francisco,
On 30/07/13 23:09, Francisco Ruiz wrote: > 4. A revamped Key strength meter, which won't give a perfect score > until the user has appended his/her email to the Key. This is to > combat a powerful attacker (like the NSA) who might be able to make > a rainbow table containing public keys for a whole dictionary's > worth of likely private keys (Thanks, Michael; not quite the same > as adding a random salt, but I think this achieves the objective > without inconveniencing the user too much). This is a neat solution to increase the difficulty of dictionary attacks without increasing the burden on the user's memory. However, I'm still concerned that dictionary attacks (without rainbow tables) would be quite easy to carry out. See the following article, for example, which describes current techniques for cracking salted passwords: http://arstechnica.com/security/2013/05/how-crackers-make-minced-meat-out-of-your-passwords/ I'd recommend using PBKDF2 or scrypt with a high iteration count to increase the cost of dictionary attacks. Perhaps the iteration count could be determined automatically using your password strength estimation algorithm, so weaker passwords would use more iterations? Cheers, Michael -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) iQEcBAEBAgAGBQJR+kNXAAoJEBEET9GfxSfMYnMH+wRWKY+gPIPyWGMyWhQkuOCb 5LtGHNnyJoCuvBN8z563HF8gjaMIDcsi6r4Z9qoBKh47Q3DN6WgAOqB13brKKBg0 VhfcjgGW8sRpvw1FGRUgg+O91ZQg+KsmvBjQetQ+u7HSj2TomreN1HV9UJWbNFUr QwYzzhXs7DoXCGkrBwfOLqNIh2CrygPrBcP77PMTCc+NdmLm5mpLd5e1N8UAiL1u ZKiBQUU7zknmRayjRbr4EjqEotQ41dTpjICcrAvRBxD5n5kz5sule/J+F6WiYDRA Yk8LcQOQmXFmMdUWPKaC1NZCyPZGiaQGWcD7n/l6fk1bzX0ZD0gpNv5vFye4XYk= =mPeB -----END PGP SIGNATURE----- -- Too many emails? Unsubscribe, change to digest, or change password by emailing moderator at compa...@stanford.edu or changing your settings at https://mailman.stanford.edu/mailman/listinfo/liberationtech
