🚀 go-pugleaf

On Mon, 13 Dec 1999 09:14:08 GMT, Raphael <rraphael_pierre@hotmail.com> wrote:
>I have a question for a assignment that is due tomorrow morning that I
>can't figure out.  I'd appreciate any help.

I'll try to give a hint...

>It was stated that the inclusion of the salt in the UNIX password scheme
>increases the difficulty of guessing by a factor of 4096.  But the salt
>may be stored in plaintext in the same entry as the corresponding
>ciphertext password. Therefore, those two characters may be known to the
>attacker and need not be guessed.  Why then is it asserted that the salt
>increases security?
>
>I have a feeling this is easy but I can't figure it out.  Can anyone
>help?

It depends on the nature of the attack being considered.  For a
single software-based attack on a single password the salt
doesn't help, but consider either an attack by DES hardware
(which is generally faster than software implementations, but
only computes the ".." salt), or a dictionary attack where one
pre-encrypts a "word" list...

		--Ken Pizzini