Penetration Testing mailing list archives
Re: Determining the encryption used
From: Tim <tim-pentest () sentinelchicken org>
Date: Fri, 12 May 2006 12:48:48 -0400
I don't mean to take it off-topic, but I couldn't resist a few comments...
However, most applications have a default preference. That is, nowadays most programs are somewhat AES-192-phile even though noone would actually recommend the use of AES (I hope).
What makes you say that? What is wrong with AES?
However, passwords or whatever stored in a database are not encrypted with a symmetric cipher most of the time (Except for DES "encoded" passwords). In this area you can usually tell the hash by the length of the stored data (but you can't correlate it to the length of the original input): 7 bytes / 56 bit -> DES
I believe the block size for DES is 64 bits, yes? Sure, the key is 56 (or 64 bits with an 8-bit checksum), but the block is different.
BTW, if you're free to choose a hash function for your program, don't use DES, MD5 or SHA1. DES isn't worth anything more than EBCDIC these days, MD5 has 8 bit of security margin left (so if you attack it, you need to bruteforce 256 possibilities to find a collision - not really hard to do), and SHA1 isn't that much safer anymore either. SHA2 isn't really good at that, but at least it didn't fall apart that much yet.
For the purpose of a one-way function, neither MD5 nor SHA1 has been broken. AFAIK, they are only vulnerable to collision attacks, not first preimage or second preimage attacks, which rely on different properties. Using these functions for specific purposes (such as hashing passwords) is perfectly fine right now.
Call to everyone: we need a new decent hash function!
Yes, we do, but not in the context you describe. tim ------------------------------------------------------------------------------ This List Sponsored by: Cenzic Concerned about Web Application Security? Why not go with the #1 solution - Cenzic, the only one to win the Analyst's Choice Award from eWeek. As attacks through web applications continue to rise, you need to proactively protect your applications from hackers. Cenzic has the most comprehensive solutions to meet your application security penetration testing and vulnerability management needs. You have an option to go with a managed service (Cenzic ClickToSecure) or an enterprise software (Cenzic Hailstorm). Download FREE whitepaper on how a managed service can help you: http://www.cenzic.com/news_events/wpappsec.php And, now for a limited time we can do a FREE audit for you to confirm your results from other product. Contact us at request () cenzic com for details. ------------------------------------------------------------------------------
Current thread:
- Determining the encryption used John Madden (May 11)
- Re: Determining the encryption used Art Cooper (May 12)
- Re: Determining the encryption used Tim (May 12)
- Re: Determining the encryption used Rodrigo Ramos (May 12)
- Re: Determining the encryption used Tim (May 12)
- Re: Determining the encryption used Byron Sonne (May 12)
- Re: Determining the encryption used Peter Kosinar (May 12)
- Re: Determining the encryption used Tonnerre Lombard (May 12)
- Re: Determining the encryption used Tim (May 12)
- Re: Determining the encryption used Phoebe Tunstall (May 12)
- Re: Determining the encryption used Peter Kosinar (May 13)
- Re: Determining the encryption used Tim (May 13)
- Re: Determining the encryption used Tim (May 12)
- RE: Determining the encryption used Sahir Hidayatullah (May 12)
- Re: Determining the encryption used thomas springer (May 12)
- Re: Determining the encryption used Dotzero (May 12)
- <Possible follow-ups>
- Re: Determining the encryption used iccs-abr (May 12)
- RE: Determining the encryption used Bob Bell (rtbell) (May 12)
- Re: Re: Determining the encryption used cwright (May 12)