[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <4DD4327A.9030702@gmail.com>
Date: Wed, 18 May 2011 22:56:26 +0200
From: bartavelle <bartavelle@...il.com>
To: john-users@...ts.openwall.com
Subject: Re: Help with 14 - 16 digit CC's stored in MD5 hash
Le 18/05/2011 20:46, Kevin Finisterre a écrit :
> - Strong one-way hash functions (hashed indexes)
I suppose this should be some kind of HMAC to be even remotely useful.
That way a simple database leak would not lead to an epic fail.
Just doing MD5 is incredibly stupid. Credit cards are mostly 16 digits,
and as mentionned previously, have predictible first digits. Moreover,
you can remove one thanks to luhn algorithm. Even with no knowledge of
the first digits, you have a 10^15 keyspace. Oclhashcat + hd5970 =
4.4*10^9 tests/s, which means 63 hours of cracking (for a single hash).
Of course this is way easier if you know the possible first digits.
(and PCI-DSS is not directly about making you secure)
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
