
Date: Thu, 31 Aug 2006 13:58:17 0700 From: "Bolan, Scott" <Scott.Bolan@...perdine.edu> To: <johnusers@...ts.openwall.com> Subject: RE: encryption strength vs. the time it takes to find the same password with different key sizes John wrote  I am trying to better understand this, so please bare with me. Lets say I have two hashes I want to crack. Each hash uses the same password. If one encryption is with 32 bit. and the other is 64 bit. would cracking the 64 bit encryption actually take longer? Even though they both use the same length password? For example: I got thinking that if you used an lowercase alpha only password, that is 6 chars long.. so 26^6 possible combos to break it.... wouldn't it be the same for each encryption strength?  This is not quit what you were asking but it might be of interest. It is my understanding that *all* 32 bit hashes can be cracked. Here is the reasoning.  Since a hash has a finite length, multiple passwords will generate the same hash. (the pigeon hole principle: there are more possible passwords then there are hashes)  a 32 bit key has 2^32 possible hashes (4,294,967,296). A big number but on a reasonable computer this is 1  4 weeks of work. So instead of a 'naive' brute for attack, (a, b, c, ... , aa, ab, ac, ...), you can try all possible hashes. This will give you *a* correct password although it probably won't give the *the* correct password. You just need to find *a* password that hashes to the correct value (there are many). I suspect that the password you found would work for the 32 bit encryption but not for the 64 bit encryption. This is because you just found one of the passwords that worked for the 32 bit encryption and not the 'actual' password. Feel free to correct me if you think I am off my rocker.  To unsubscribe, email johnusersunsubscribe@...ts.openwall.com and reply to the automated confirmation request that will be sent to you.
Powered by blists  more mailing lists