# What time do dictionary attack take on salted passwords?

I was reading that the designers of UNIX password algorithm used a 12 bit salt to modify the E-table of the unix hashing function (the DES). Supposing i have a system with 2^(24) users?

Is that ever possible to user dictionary attack? and if so how long would it take? years??

I am really new on computer security

Edit: I am not sure what unit time i guess i have to assuming bytes per minute depending on my code?

The reason I am asking is for a project where one of the questions states: "Consider a system with 2^24 users. Assume that each user is assigned a salt from a uniform random distribution and that anyone can read the password hashes and salt for users." What is expected time to find all users' passwords using dictionary attack?"

-
Let's just skip to the end a little here, that's the original UNIX password algorithm, most UNIX passwords use bcrypt, sha-1, sha-256, sha-512 or md5 these days. Usually salted. DES is considered able to be bruteforced in all cases. – ewanm89 Apr 25 '12 at 17:31
Thanks, I was actually trying to calculate how long would it take to be broken. – superfloyd Apr 25 '12 at 18:08
now you've explained why you are asking we might as well answer properly. – ewanm89 Apr 25 '12 at 18:47
The wikipedia page on the crypt() function. – ewanm89 Apr 25 '12 at 18:54
The answer is the same for every user. The time it takes to brute force every possible password for a given salt. When you have 16 million users it is going to take awhile. In probability theory and statistics, the continuous uniform distribution or rectangular distribution is a family of probability distributions such that for each member of the family, all intervals of the same length on the distribution's support are equally probable. – Ramhound Apr 26 '12 at 16:44

In the worst case (from the perspective of the security defense, not the attacker), salts do not add any time.

All hashing functions, in principle, have a salt: some initial state which is perturbed by passing the string through the algorithm. It's just a question of whether the salt is modifiable (is a parameter of the hash) or fixed.

A hashing function which uses a fixed initial state table of, say, 32 all-zero bits is no faster than one which lets those bits be specified as a parameter, which is then kept together with the hash as a salt.

It is not the purpose of salts to slow down a dictionary attack on a specific set of passwords. The purpose of a salt is to increase the space (well, and time) required to build a pre-computed dictionary ("rainbow table").

If a salt vector has two billion combinations, then a dictionary word like `password` hashes up to two billion different ways with the same hashing function, for different salts. If the attacker then wants a database which supplies you with a instant reverse lookup from a hash back to the word `password`, then it needs two billion entries just for that one word. That's a lot of storage to dedicate to instantly cracking just one word.

In the absence of salts, approximately that same amount of storage would give you reverse lookup for two billion words: something likely to be very useful in actual cracking.

-

I think the answer depends on what type of class you're taking. This could be a time complexity problem (theoretical) or more practical.

In either case, here is what you know: you have a fairly large user population, each user has a unique salt, and anyone can read the salt and password hash for any user. You find a link to a benchmark of a large list of ciphers and hash functions here, which can be used as a guide to figure out how much data you can pump through a hash function. Without giving away too much, figure out what the purpose of adding a salt value provides in computing a hash.

Good luck.

-