Re: mlock(1)

From: Pavel Machek (pavel_at_suse.cz)
Date: 09/30/04

  • Next message: Patrick McHardy: "Re: ip_nat_helper / ip_conntrack_core issues with recent 2.6 kernels" 
    Date:	Thu, 30 Sep 2004 21:52:28 +0200
To: Andrea Arcangeli <andrea@novell.com>

    Hi!

    > > Actually if your cipher is not resistant to known plaintext attack,
    >
    > AFIK the only way to make it resistent to a brute force is to make it
    > slow, like adding lots of bits of salt.

    No. If you want it resistent to brute force, use big key. Actually 128bit should be enough.

    If user's password has at least 128 bits of entropy, you should be safe, too.

    salt only helps with "lets create 1TB of all common encrypted passwords" attack.

    > My point is very simple, that is if you leave a zero as part of the API,
    > then you're making things less secure.

    This is same as saying that starting encrypted email with
    "Hi!" is bad idea. It is not. Don't worry about brute-force, it is not
    practical. (Okay, you probably should not limit password length to 8 chars).

                                    Pavel 

    -- 
64 bytes from 195.113.31.123: icmp_seq=28 ttl=51 time=448769.1 ms         
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/
  • Next message: Patrick McHardy: "Re: ip_nat_helper / ip_conntrack_core issues with recent 2.6 kernels"

    Relevant Pages

    • Re: store salt in database
      ... To my understanding the salt is used to make it difficult to ... apply 'brute force' to decypher passwords, if the database is compromised by ... But if a hacker knows the salt, cause it is stored in the ... you have a database of one million users and you do ...
      (sci.crypt)
    • Re: store salt in database
      ... assigned a salt to hash their password with. ... apply 'brute force' to decypher passwords, if the database is compromised by ... a hacker, right? ... It will take them just as long to attack 1 user ...
      (sci.crypt)
    • Re: store salt in database
      ... assigned a salt to hash their password with. ... users, and the database is compromised, the use of such individual salts ... apply 'brute force' to decypher passwords, if the database is compromised by ... a hacker, right? ...
      (sci.crypt)