Quote from: imperi on July 07, 2011, 06:26:19 PM

Quote from: nealmcb on July 07, 2011, 06:16:28 PM

00000000000000001e8d6829a8a21adc5d38d0a473b144b6765798e61f98bd1d 125552

So is this the equivalent of brute forcing a 64 bit password?

edit:

I mean a password that is 64 bits long, encrypted with SHA-256.

This is actually quite a different thing - it is finding a password which would hash to the same value, if the output of the hash was only 64 bits (really 67, FWIW).

If the password hashing algorithm was really awful, without salt or iterations (i.e. worse than what we had in 1978), these might require similar amounts of effort. But a modern hashing algorithm like PBKDF2 or bcrypt or scrypt would make things much much harder.

See more on how password hashing should really be done at How to securely hash passwords? - IT Security - Stack Exchange

nealmcb

Posts

Merits