🚀 go-pugleaf

Raphael <rraphael_pierre@hotmail.com> writes:
>I have a question for a assignment that is due tomorrow morning that I
>can't figure out.  I'd appreciate any help.
>Here goes:

>It was stated that the inclusion of the salt in the UNIX password scheme
>increases the difficulty of guessing by a factor of 4096.  But the salt
>may be stored in plaintext in the same entry as the corresponding
>ciphertext password. Therefore, those two characters may be known to the
>attacker and need not be guessed.  Why then is it asserted that the salt
>increases security?

>I have a feeling this is easy but I can't figure it out.  Can anyone
>help?

The salt protects against a systamatic dictionary attack against a
long list of passwords. It ensures that if two users both pick the
word 'elephant' for their passwords, that the crypted password entries
for both of them won't be identical (if the random generator is good
enough, there's only a 1:4096 chance in them being identical).

Instead, the password hacker has to scan through the list of crypt'd
passwords, find the salt for each one, and then seed the crypt
algorithm with the salt for each password entry and try all the
dictionary words. This is instead of crypting each dictionary entry,
and then comparing it to every password in the list. 


--
Doug McIntyre						merlyn@visi.com
  Network Engineer/Tech Support/Jack of All Trades of Vector Internet
Due to circumstances beyond your control, you are master of your fate
and captain of your soul.