Vulnerability Development: Re: OpenSSH Password Question

["Bluefish (P.Magnusson)" <11a () GMX NET>]

> > Assume you use strong passwords with a-zA-Z0-9 and 8 characters long
> > passwords. You get 36^8 possible different passwords, [...]
> a-zA-Z0-9 is 62, no? So it'd be 62^8?
Yep, must have been asleep while typing. The assumption was based on
a-z0-9 or something. And yes, you are right on crypt() being 64 bits.

Silly me! :)

Anyway, looked at the bcrypt papers pointers were refering to? If the
scheme is considered to be safe by cryptographers, it's one pretty neat
idea, adding a factor of 2^cost [where cost is an variable] to the time
complexity of the algorithm.

..:::::::::::::::::::::::::::::::::::::::::::::::::..
     http://www.11a.nu || http://bluefish.11a.nu
    eleventh alliance development & security team

             http://www.eff.org/cafe