Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

This question already has an answer here:

I just made a new account with some eGov service (Belgian government). I use LastPass (which generates long, random strings for each site),

But the system told me that the maximum allowed length was 16 ASCII symbols. Why do people do this? If they hash it, then the length should not matter, right?

Is there a reason for this? I cannot see a any good explanation for this. What am I missing something here?

share|improve this question

marked as duplicate by Adnan, Noordung, Terry Chia, Jeff Ferland Jun 13 '13 at 16:04

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

1 Answer 1

Some hash functions are based on block ciphers like DES. The maximum (effective) input size of these algorithms are limited by the block-size of the internal cipher. See for example:

http://man7.org/linux/man-pages//man3/crypt.3.html

https://en.wikipedia.org/wiki/LM_hash

There is of course a non-negligible possibility (we are talking about eGov) that the password storage of your particular service is fundamentally flawed.

share|improve this answer
3  
LM-hash&co are totally broken –  CodesInChaos Jun 13 '13 at 14:59

Not the answer you're looking for? Browse other questions tagged or ask your own question.