Hi Vasily, On 10/11/2011 04:30 PM, Vasiliy Faronov wrote: > Hi Jeremy, > > Could you please reveal details on how the passwords were "encrypted"? > Which hash function, were they salted, was the salt compromised. > > This would help the users evaluate just how much is "enough effort" > to crack the passwords. I'll give you a short answer; if I get more details, I'll supply the long one. The bugs database is bugzilla; we simply use bugzilla standard encryption. The current form of that is a fairly complex salted sha 256 string. However, that started in bugzilla version 4, which was released only this year. For passwords encrypted in bugzilla prior to that, a simple crypt() was used. I haven't yet looked at the bugzilla code to determine if it was salted or not, or exactly how that crypt() was called. The encrypted text is roughly the same length as a 64 bit DES encryption. The appdb uses the sha1() mysql function which is a straight forward sha1sum. I have yet to find a password that yields to a very simple crack attempt (using john, and hashcrack.com), but I have not tried in any systematic way. I won't claim to be a cryptography expert, as I'm not. My back of the envelope analysis is that if you have a moderately complex password, you will likely be safe from any straight forward attempts to crack your password. You may still be at risk to an extended brute force attack. But here my ignorance kicks in; I don't know where the curve of password length + complexity matches the curve of 'time required to brute force an sha1'. On the other hand, if you use a password that is a dictionary word, or only a trivial distance from a dictionary word, then I would suspect your password would fall to a fairly basic dictionary attack. Cheers, Jeremy
