Re: Values to use for a salt?
Chris Alfeld <[email protected]>
| Newsgroups | gmane.comp.security.programming |
|---|---|
| Message-ID | <[email protected]> |
I think this is an example of strengthening the strongest link in the chain, which is pretty pointless while weak links remain. We're not going to start having users use 8-bit passwords so the password search space remains the same. While extending the salt to 8-bits would make a salt-space of 8^n instead of 7^n, which is a significant increase, 7^n is still a huge salt space. In any case, 7-bit vs 8-bit in no way addresses the problem that salts solve, namely preventing pre-crypting of entire dictionaries. > Don't you think using extendedASCII set will dramatically increase the > performance of any algorithm currently in use? Imagine what a pass like > "|¤W-|[V.|1D-|`â-|Ë3-|%-|F0-| " means for a cracker: (selected from line > 22 (I think...) from regedit.exe). Imagine using Unicode characters for keys > ... > Will you still need salt and others?