[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20181029180300.GA16596@openwall.com>
Date: Mon, 29 Oct 2018 19:03:00 +0100
From: Solar Designer <solar@...nwall.com>
To: passwords@...ts.openwall.com
Subject: Re: Bloom filter patent
On Mon, Oct 29, 2018 at 09:33:08AM -0800, Royce Williams wrote:
> On Mon, Oct 29, 2018 at 8:01 AM Solar Designer <solar@...nwall.com> wrote:
> > "Blackfish doesn't store passwords
> >
> > The security of the Blackfish system itself was the most important
> > design consideration. Shape's patented design uses a Bloom filter,
> > enabling Blackfish to perform lookups of your user's credentials without
> > maintaining a database of compromised passwords."
>
> According to this cache of Passwords '14 proceedings, Blackfish was around
> at that time:
>
> https://books.google.com/books?id=iyXUCgAAQBAJ&pg=PA141&lpg=PA141&dq=%22passwords%22+%22bloom+filter%22
Also:
https://github.com/kholia/Blackhash
0.1 2013-11-08 Original version of Blackhash released.
Note: this is Blackhash, not Blackfish.
> Potential other prior art and/or informative links, not yet analyzed (some
> suggested to me off-list after a side query):
>
> https://pdfs.semanticscholar.org/ce61/eef0efd3544c8df43324cbe4e05ba12a610a.pdf
> (Spafford, 1991 - "OPUS")
> https://docs.lib.purdue.edu/cgi/viewcontent.cgi?referer=&httpsredir=1&article=1969&context=cstech
> (Spafford, 1992)
> https://www.usenix.org/legacy/event/hotsec10/tech/full_papers/Schechter.pdf
> (Schecter, Herley, Mitzenmacher, 2010)
>
> https://github.com/krisives/bloomer-php (2015)
> https://gist.github.com/marcan/23e1ec416bf884dcd7f0e635ce5f2724
> https://www.bloomingpassword.fun/
> https://github.com/reedy/mw-password-bloom-filter
> https://github.com/jthomas/serverless-pwned-passwords (2017)
> https://cs.unc.edu/~fabian/courses/CS600.624/slides/bloomslides.pdf
> https://cry.github.io/nbp/
That's an impressive collection. OPUS from 1991 is especially good as
prior art. Also highly relevant and fairly early is slide 23 in
bloomslides.pdf from 2006 suggesting use of "strong hash functions" to
"store sensitive data (previously used passwords)" in a Bloom filter.
With abundance of prior art like that, do we even need to care about a
possible (invalid) patent that might be issued now?
Thanks!
Alexander
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
