Re: [Cfrg] 答复: Re: [saag] New draft: Hashed Password Exchange

Applying a function to a random variable can never increase its
entopy.  See chapter 2 of Cover & Thomas' "Elements of Information
Theory", exercise 5, which shows that for any function g and random
variable X in the domain of g,

	H( g(X) ) <= H(X) 

(where H(Z) = the entropy of a random variable Z).

In our case g is a hash function, X is the original password and 
g(X) is the hash of the password. Then a hashed password cannot
have more entropy than the original password and may in fact 
have less entropy.

> -----Original Message-----
> From: cfrg-bounces@irtf.org [mailto:cfrg-bounces@irtf.org] On Behalf Of
> Blumenthal, Uri - 0668 - MITLL
> Sent: Wednesday, February 01, 2012 4:46 PM
> To: cfrg@irtf.org
> Subject: Re: [Cfrg] 答复: Re: [saag] New draft: Hashed Password
> Exchange
> 
> On 2/1/12 12:11 , "Rose, Greg" <ggr@qualcomm.com> wrote:
> 
> >On 2012 Feb 1, at 0:13 , <zhou.sujing@zte.com.cn>
> ><zhou.sujing@zte.com.cn> wrote:
> >> Since passwords are often not too long, and not so random, it is
> better
> >> to hash it before using it as a key in a HMAC.
> >
> >I'm afraid this is a fallacy. While it will be longer, and will look
> >random, there is exactly the same (lack of) entropy in a hashed weak
> >password as there is in the original password. It's still vulnerable
> to
> >password search, although with a slightly increased workload due to
> the
> >(single) extra hash invocation.
> 
> Concur 100%.
> 
> _______________________________________________
> Cfrg mailing list
> Cfrg@irtf.org
> http://www.irtf.org/mailman/listinfo/cfrg