Without a built-in workload, modern attacks can compute large numbers of hashes, or even exhaust the entire space of all possible passwords, within a very short amount of time, using massively-parallel computing (such as cloud computing) and GPU, ASIC, or FPGA hardware. If an attacker can obtain the hashes through some other method (such as SQL injection on a database that stores hashes), then the attacker can store the hashes offline and use various techniques to crack the passwords by computing hashes efficiently. However, this efficiency is a problem for password storage, because it can reduce an attacker's workload for brute-force password cracking. Many hash algorithms are designed to execute quickly with minimal overhead, even cryptographic hashes. In this design, authentication involves accepting an incoming password, computing its hash, and comparing it to the stored hash. Many password storage mechanisms compute a hash and store the hash, instead of storing the original password in plaintext.
0 kommentar(er)
