If there is, most of the people don't know about it, but will still jump in to defend their dogmas till the last drop of sweat.
I'm a cryptography illiterate, I know zero besides the basics, i.e. common sense. But it does annoy me deeply, the amount of people talking about cryptography with a pretentious attitude.
I am glad you ask that question, and I'm suspecting nobody will say 'yes'.
The main problem with this question is I get a lot a answer that simply aren't answer to this question, but only the basic good usage of cryptography.
Until here, nobody said 'yes', then I assume my method is secure.
I would have loved to know if this specific question is asked for any kind of hash function, or if nobody never ask such question. For me it seems as a natural question which seem a bit more difficult than finding a collision but easier than cracking completely the hash function.
Thanks for your answer. Could you explain me how my method is not secure assuming:
1. The pass is long
2. The preimage is known
If nobody can find `sha1(knownpart|hiddenpart)`, how is my method insecure?
Is the problem linked to sha1 or if I use any other hash this method also fail?
I presume the _only_ method you advocate for is to have a lot of different passwords for each website is to store randomly generated password inside a keychain system. Could you enlighten me? How do you deal with your own password?
Thanks.
edit: it seems we reached the max depth. Thank you Dmitry!
Comments
If there is, most of the people don't know about it, but will still jump in to defend their dogmas till the last drop of sweat.
I'm a cryptography illiterate, I know zero besides the basics, i.e. common sense. But it does annoy me deeply, the amount of people talking about cryptography with a pretentious attitude.
I am glad you ask that question, and I'm suspecting nobody will say 'yes'.
The main problem with this question is I get a lot a answer that simply aren't answer to this question, but only the basic good usage of cryptography.
Until here, nobody said 'yes', then I assume my method is secure.
I would have loved to know if this specific question is asked for any kind of hash function, or if nobody never ask such question. For me it seems as a natural question which seem a bit more difficult than finding a collision but easier than cracking completely the hash function.
To answer your question, AFAIK there are no known first preimage attacks on SHA-1 yet.
And no, your method is not secure.
Thanks for your answer. Could you explain me how my method is not secure assuming:
If nobody can find `sha1(knownpart|hiddenpart)`, how is my method insecure?Is the problem linked to sha1 or if I use any other hash this method also fail?
I presume the _only_ method you advocate for is to have a lot of different passwords for each website is to store randomly generated password inside a keychain system. Could you enlighten me? How do you deal with your own password?
Thanks.
edit: it seems we reached the max depth. Thank you Dmitry!
Table on estimated cost of hardware to crack a password in 1 year from scrypt paper: http://i.imgur.com/sAOwS.png
I personally use a scheme similar to yours, but with PBKDF2. Also, I'm no crypto expert.