News for hackers. Stuff that matters.
Re:OVH Security Incident by hbbio on Monday July 22, 2013 @11:09AM (#6084141)
Maybe SHA-512, salted?
Re:OVH Security Incident by tptacek on Monday July 22, 2013 @12:10PM (#6084623)
Salted SHAx passwords are basically the entire reason GPU John The Ripper and oclHashcat exist, although SHA2-512 is significantly slower than SHA2-256, so if you're going to use a terrible SHA-based password hash, SHA2-512 is your best bet.
Re:OVH Security Incident by JshWright on Monday July 22, 2013 @02:35PM (#6085613)
SHA512 is slower on most (all?) current GPUs, but there is plenty of hardware on which it is faster than SHA256.
Re:OVH Security Incident by tptacek on Monday July 22, 2013 @02:44PM (#6085680)
Hm. Example?
Re:OVH Security Incident by JshWright on Tuesday July 23, 2013 @05:24AM (#6089006)
It'll (theoretically) be faster on any hardware that supports 64 bit operations, as SHA512 ends up doing fewer block operations.

This assumes you're hashing something at least 8 bytes long, and that your hash implementation is smart enough to use the 64 bit capabilities of your platform.

Re:OVH Security Incident by epsylon on Monday July 22, 2013 @11:14AM (#6084184)
Yep, in the french version of the message they specify that it's salted.

http://travaux.ovh.net/?do=details&id=8998