News for hackers. Stuff that matters.

A comment on Midnight project: Password manager without a password manager. Parent comment

Re:Midnight project: Password manager without a password man... by dexen on Monday August 13, 2012 @06:02AM (#4375169)
> I think this is catastrophically broken because of a known issue of how SHA-2 breaks its input into blocks: when A is aligned to a block boundary, sha(A || B) = f(sha(A), g(B)).

If that's the case, wouldn't it suffice to mix A and B, for example with byte-wise XOR?

  password ::= sha(A XOR B)
[ Parent | on HN ]
Re:Midnight project: Password manager without a password man... by jaseg on Monday August 13, 2012 @07:33AM (#4375339)
Though that would be hard to do in a one-line shell script, which was the idea behind the gist.
[ Parent | on HN ]