I designed a WiFi host whose password contains a truncated SHA256 hash of a password + the time it was set.
For example, “password2019-12-25-12:59” hashed to “acd2775f” which is truncated to 8 digits (by the way, not the real hash).
The password changes every X minutes based on the time it was modified. So the hash changes (a lot, obviously).
The fact that it actually changes every 3 minutes, makes me feel pretty safe, because even if an attacker knew the algorithm (pass+date) they wouldn’t know the password which has no length limit.
So the attacker would have 2 options:
- He can try cracking directly the N digit passphrase in that small period of time.
- (assuming he knows the algorithm) He can make a list of all possible hashes for a certain time when he captured a random handshake and bruteforce it. In the end, he would get the secret password of my formula and authenticate.
The second method concerns me the most because the secret password usually doesn’t change. The attacker should guess N (the number of digits) to get to the WPA2 passphrase by hashing strings and trying.
Assuming that the impact of a breach to this system may cause very severe damages:
How critical is this vulnerability? Is it enough to make this system directly obsolete?
Apart from changing the ‘secret password’ frequently to increase the security, are there any other ideas I should know?
COMMENT: I understand that this system is a little confusing, so feel free to ask my any questions or whatever you want to contribute.