One topic that is interesting in this discussion, particularly given its absence is the process of "salting" - adding a random string to password and the hash.

Ok - so the default unix variety that addes two characters isn't a particularly great enhancement, but by adding an extra 64bits (or more) to the begining of the hash you add an awful lot of extra combinations to be included in rainbow tables.

Additionally - authentication hashes can, to a certain extent be "computationally" expensive - again making rainbow tables more time consuming to generate - does this solve the basic problem ? Not really ... but then again there isn't going to be a "perfect" system.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/articles/11355/32701#32701