🚀 go-pugleaf

> Thus, in order to decode the password, one would have to find a
> password whose MD5 was represented in base64 as xEeZmr2fGEnKjVAxzj/o51 .
>
> MD5 is a 128 bit hash, so brute force would require an
> average of 2^127 operations to find a match. That's a lot of
> computation.

I wonder if the techniques to generate the MD5 hash collisions[1] could
also be used to cut down the search space for finding an inversion.

In any case, average people don't pick passwords that take much
search-space to find.  Having a 128-bit search-space for the hash
doesn't buy you much if probability-density-function for the chosen
password strings is highly non-linear.  If one only has to test the
10,000 or 100,000 most likely passwords to break 15% of the users
passwords having a fancy hash representation in the shadow file isn't
going to buy one much.  The weak link is still the user's password.

I'm beginning to think the only way to really protect systems is to
have a $20 usb flash card that is given to each user.  The flash card
would contain a 1k-bit key (say ssh's rsa or dsa).  The user's
password is ONLY used to decrypt the 1k-bit key.  Even if the user
chooses a losing password that is in every cracker's dictionary, it
won't help an external attacker any.  The external attacker needs to
search the 1k-bit long space unless they happen to be able to be able
to steal the usb flash card.  If they steal the usb card, then and
only then, will they be able to throw the much smaller cracker
dictionary against the users 1k-bit key and try to decrypt it.

-wolfgang

[1] eprint.iacr.org/2004/199.pdf - Collisions for Hash Functions MD4,
    MD5, HAVAL-128 and RIPEMD, Xiaoyun Wang, Dengguo Feng, Xuejia
    Lai, Hongbo Yu
-- 
Wolfgang S. Rupprecht                http://www.wsrcc.com/wolfgang/
	 When you talk to musicians about pirates they think
		   you are talking about the RIAA.