I think the issue here, is that if my password is 'asdf' ( it isn't
), then the sha1 hash will be
'3da541559918a808c2402bba5012f6c60b27661c'. This means that someone
can create a table mapping '3da541559918a808c2402bba5012f6c60b27661c'
to 'asdf'. This kind of table is called a rainbow table.

I don't think it's of much benefit hashing more than once. If that was
the standard practice, then an attacker instead would map
'30a518b67dcd7af15b369ccb1518ab3cad8e8b2c' ( 'asdf' sha1-hashed twice
) to 'asdf'.

I imagine including the username and org in the hash would improve the
situation ( in which case, you would hash a concatenation of the
username, password, and org ). Does anyone know of any security
problem, where instead of salting with a random number ( which IIUC
would need to be stored as well ), the hash was salted with the
username and the org. That way, two different users with the same
password would have different hashes, and the hashes would also be
different from any other system.

Rory

On 11 June 2012 18:55, Ansgar Wiechers <bugtraq (at) planetcobalt (dot) net [email concealed]> wrote:
> On 2012-06-11 haZard0us wrote:
>> This may well be a silly question but, with this recent hashed
>> password leakage, I want to ask something about properly hashing.
>>
>> The "manuals" say that we should create a salt and then hash it. But,
>> since calculating an hash is a "relative simple" operation (in matter
>> of processing power), is hashing two or three times the password (hash
>> over hash) a "kind of" secure method or it is as weak as not using
>> salt at all?
>>
>> It can still be cracked but...
>
> Yes, it can still be cracked. However, salting passwords defeats the
> advantages gained from using rainbow tables, so cracking the password
> will still take a significantly longer time than it would for an
> unsalted password.
>
> Regards
> Ansgar Wiechers
> --
> "All vulnerabilities deserve a public fear period prior to patches
> becoming available."
> --Jason Coombs on Bugtraq
>
> ------------------------------------------------------------------------

> Securing Apache Web Server with thawte Digital Certificate
> In this guide we examine the importance of Apache-SSL and who needs an SSL certificate.  We look at how SSL works, how it benefits your company and how your customers can tell if a site is secure. You will find out how to test, purchase, install and use a thawte Digital Certificate on your Apache web server. Throughout, best practices for set-up are highlighted to help you ensure efficient ongoing management of your encryption keys and digital certificates.
>
> http://www.dinclinx.com/Redirect.aspx?36;4175;25;1371;0;5;946;e13b6be442
f727d1
> ------------------------------------------------------------------------

>

------------------------------------------------------------------------

Securing Apache Web Server with thawte Digital Certificate
In this guide we examine the importance of Apache-SSL and who needs an SSL certificate. We look at how SSL works, how it benefits your company and how your customers can tell if a site is secure. You will find out how to test, purchase, install and use a thawte Digital Certificate on your Apache web server. Throughout, best practices for set-up are highlighted to help you ensure efficient ongoing management of your encryption keys and digital certificates.

http://www.dinclinx.com/Redirect.aspx?36;4175;25;1371;0;5;946;e13b6be442
f727d1
------------------------------------------------------------------------

[ reply ]