Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 24 May 2012 23:05:42 +0200
From: Frank Dittrich <>
Subject: Re: Can Excessive Rounds make Password cracking Infeasable

On 05/24/2012 10:49 PM, magnum wrote:
> As others pointed out there are reasons the default rounds figure is not
> higher. I can imagine if just *some* or even only one hash had a much
> higher round, I would get more interested in those. OTOH this could be
> used to fool attackers (using a couple of impossible passwords with a
> very high rounds figure) to waste resources on dummy accounts.

Even without changing the iteration count, this might be an idea:
Against attackers who might get hold of the hashes, but can't tell real
users from fake users, you can just create a large number of dummy
accounts with very hard to crack passwords.
Then, the attackers will have a much higher number of different salts,
slowing down the speed of their cracking attempts, without increasing
login time for real users.
Of course, this doesn't help against malicious insiders.


Powered by blists - more mailing lists

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.