Re:Auditor's response to "Our security auditor is an idiot" ...
by gus_massa on Friday July 29, 2011 @09:56AM
(#2821734)
If you use a different salt for each modification of the old password, you must compute the all the hashes of the new password.
Another problem is that to prevent the use of the very old passwords, you should keep the hashes of the modifications. To make the comparations fast, you have to use the same hash.
Now you have a list of #password-changes * #passwords-modifications, and if an intruder get them, it is possible to make a mini-rainbow attack.
Another problem is that to prevent the use of the very old passwords, you should keep the hashes of the modifications. To make the comparations fast, you have to use the same hash.
Now you have a list of #password-changes * #passwords-modifications, and if an intruder get them, it is possible to make a mini-rainbow attack.