[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20120811022637.GB32024@openwall.com>
Date: Sat, 11 Aug 2012 06:26:37 +0400
From: Solar Designer <solar@...nwall.com>
To: john-dev@...ts.openwall.com
Subject: Re: SRP
On Fri, Aug 10, 2012 at 01:46:09PM -0500, Jeffrey Goldberg wrote:
> I have to confess about being really confused by what Blizzard said about SRP. SRP is about securing a peer to peer key exchange. It has nothing (as far as I understand) to say about how passwords are stored.
>
> So SRP may be used between Blizzard's front-end and back-end servers to prevent evil done through sniffing or tampering with that interchange. But the backend server, still hashes (or not) the user data as it sees fit. A breach of the back-end server (as seems to have happened here) makes the use of SRP irrelevant.
Yes, almost - but not to the point of us needing no SRP-specific code to
crack those passwords. We'll need extra code at least to turn the
verifiers into SHA-1's (or whatever hash Blizzard used), as per Jeremy's
latest post - or we'd need extra code while cracking, as it was expected
before.
> The SRP documents *recommend* that the back-end store passwords using PBKDF2, but it is something outside of the domain of the actual protocol. So only Blizzard and the people who have the data know at this point how the data is hashed.
Right.
Alexander
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
