Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I was reading that the designers of UNIX password algorithm used a 12 bit salt to modify the E-table of the unix hashing function (the DES). Supposing i have a system with 2^(24) users?

Is that ever possible to user dictionary attack? and if so how long would it take? years??

I am really new on computer security

Edit: I am not sure what unit time i guess i have to assuming bytes per minute depending on my code?

The reason I am asking is for a project where one of the questions states: "Consider a system with 2^24 users. Assume that each user is assigned a salt from a uniform random distribution and that anyone can read the password hashes and salt for users." What is expected time to find all users' passwords using dictionary attack?"

share|improve this question
Let's just skip to the end a little here, that's the original UNIX password algorithm, most UNIX passwords use bcrypt, sha-1, sha-256, sha-512 or md5 these days. Usually salted. DES is considered able to be bruteforced in all cases. – ewanm89 Apr 25 '12 at 17:31
Thanks, I was actually trying to calculate how long would it take to be broken. – superfloyd Apr 25 '12 at 18:08
now you've explained why you are asking we might as well answer properly. – ewanm89 Apr 25 '12 at 18:47
The wikipedia page on the crypt() function. – ewanm89 Apr 25 '12 at 18:54
The answer is the same for every user. The time it takes to brute force every possible password for a given salt. When you have 16 million users it is going to take awhile. In probability theory and statistics, the continuous uniform distribution or rectangular distribution is a family of probability distributions such that for each member of the family, all intervals of the same length on the distribution's support are equally probable. – Ramhound Apr 26 '12 at 16:44

I think the answer depends on what type of class you're taking. This could be a time complexity problem (theoretical) or more practical.

In either case, here is what you know: you have a fairly large user population, each user has a unique salt, and anyone can read the salt and password hash for any user. You find a link to a benchmark of a large list of ciphers and hash functions here, which can be used as a guide to figure out how much data you can pump through a hash function. Without giving away too much, figure out what the purpose of adding a salt value provides in computing a hash.

Good luck.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.