5

Let's suppose I know a website is using BCrypt with salts and the default round of 10. Can I do a dictionary attack by hashing all the words using BCrypt with the same parameters?

Improve this question
1
  • For what it's worth, the standard BCrypt output encodes both the salt and the work factor in the output string. In other words, if you know the site is using BCrypt, you should be able to get the work factor from the hash output. Even if you don't know that the site is using BCrypt, it's generally pretty easy to tell, because all the hashes will start with $2a$10$... or something similar.
    – Joseph Montanaro
    Mar 2, 2017 at 0:51

1 Answer 1

Reset to default
3

Yes, you can. bcrypt, (and other similarly slow password hashing functions) aren't designed to make this impossible, but only to make it prohibitively expensive. Weak passwords are still susceptible to being discovered, but the amount of work an attacker needs to do goes up substantially, and compared to a fast hashing function, much weaker passwords become infeasible to crack due to the extra work required for each guess.

Improve this answer
2
  • 3
    And the salt would force you to hash every word in the dictionary once per password you want to crack.
    – Anders
    Mar 1, 2017 at 21:49
  • 2
    @Anders Correct. I assumed from the OP's question that was understood, but that's a good clarification.
    – Xander
    Mar 1, 2017 at 21:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .