News for hackers. Stuff that matters.
Re:How To Safely Store A Password by a_m0d on Tuesday December 14, 2010 @09:20PM (#2006754)
If I understand the grandparent correctly, there would be no way to determine which rows have a higher work factor. The work factor would be determined when the password is given, based on the password entropy - the correct password will always have the same entropy, therefore the same work factor. If the work factor is calculated on the wrong password (typo, etc.) it will not generate the correct hash anyway. Therefore an attacker has no way of determining which password hashes have a high work factor, and which ones have a low work factor.
Re:How To Safely Store A Password by jasonwatkinspdx on Thursday December 16, 2010 @01:16AM (#2011278)
Ah, yes, I'd missed that. Since you have the password at login time, you don't need to store the work factor. There are some practical things about making sure you can version the entropy estimate code without breaking existing logins, but it's certainly doable.