0

Essentially, what's the next step up from plaintext password storage? I suspect the answer is going to be MD5, but I'm not familiar with a broad enough variety of examples to be sure.

The reason that I ask is that I'm trying to determine an appropriate strength to shoot for when generating passphrases. I know that a dedicated cracking rig like this one can run MD5 hashes at around 300 billion per second, so I'm thinking a minimum of about 67 bits of entropy (~10 years to crack.)

Is it reasonable to treat MD5 as the lower limit for password hashing?

EDIT: To clarify, I'm not trying to store passwords, and if I were I certainly wouldn't be using MD5. I'm just trying to figure out what's the worst-case scenario I'm likely to run into as a user, so that I can set a reasonable minimum complexity for my passphrases. Obviously the true worst case would be plaintext password storage, but in that case no amount of complexity will save me.

I'm pulling from a dictionary of 15 thousand words, which gives my passphrases an entropy of ~14 bits per word. So a 5-word passphrase should get me up to about 70 bits of entropy, which should be enough to defend against most attacks even if the password is stored via MD5.

My question essentially boils down to "Is there some other commonly-used hashing algorithm, that's even faster than MD5, that I should be aware of?" If there is, then I need to reconsider my passphrase strength.

Improve this question
10
  • outside of targeted attacks, nobody is going to waste cpu on more than 12-14 chars of password
    – dandavis
    Apr 19, 2018 at 0:32
  • There are many weak hashes, md5 is not the weakest. However it does not matter much, since even with MD5 password policies would be unreasonable. If you want to define your personal password length keep in mind that not all sites accept long passwords or will truncate them or do not hash at all. If you use unique passwords per site you don’t have to worry about brute forcing them anyway. 67bits in hex will be 17 characters which might be longer than some sites allow. Add some special chars and go for 16 length I would suggest.
    – eckes
    Apr 19, 2018 at 1:18
  • 1
    @dandavis sure they will. They'll just use a dictionary attack rather than exhaustive search.
    – forest
    Apr 19, 2018 at 2:46
  • @forest: With the talk of rates, I presumed OP's phrase will not be found in a dictionary and must be brute-forced, was I too generous?
    – dandavis
    Apr 19, 2018 at 2:50
  • @dandavis A hybrid attack can take a smaller dictionary (even one small enough to fit in the L3 cache) and permute it, giving benefits of both dictionary attacks and exhaustive search. You can easily attack long passwords that way. Hybrid attacks are actually the most common.
    – forest
    Apr 19, 2018 at 2:52

1 Answer 1

Reset to default
1

Depending on your definition of "common," DES with passwords truncated to 8 characters (for which rainbow tables exist).

Improve this answer
1
  • I doubt (maybe hope is a better word) this is really that common any more. Raw MD5/SHA-1/SHA-2 with or without a salt are probably a few orders of magnitude more common, although it's hard to get any realistic data here.
    – Stephen Touset
    Apr 19, 2018 at 0:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .