Take the 2-minute tour ×

I was reading that the designers of UNIX password algorithm used a 12 bit salt to modify the E-table of the unix hashing function (the DES). Supposing i have a system with 2^(24) users?

Is that ever possible to user dictionary attack? and if so how long would it take? years??

I am really new on computer security

Edit: I am not sure what unit time i guess i have to assuming bytes per minute depending on my code?

The reason I am asking is for a project where one of the questions states: "Consider a system with 2^24 users. Assume that each user is assigned a salt from a uniform random distribution and that anyone can read the password hashes and salt for users." What is expected time to find all users' passwords using dictionary attack?"

share|improve this question
Let's just skip to the end a little here, that's the original UNIX password algorithm, most UNIX passwords use bcrypt, sha-1, sha-256, sha-512 or md5 these days. Usually salted. DES is considered able to be bruteforced in all cases. –  ewanm89 Apr 25 '12 at 17:31
Thanks, I was actually trying to calculate how long would it take to be broken. –  superfloyd Apr 25 '12 at 18:08
now you've explained why you are asking we might as well answer properly. –  ewanm89 Apr 25 '12 at 18:47
The wikipedia page on the crypt() function. –  ewanm89 Apr 25 '12 at 18:54
The answer is the same for every user. The time it takes to brute force every possible password for a given salt. When you have 16 million users it is going to take awhile. In probability theory and statistics, the continuous uniform distribution or rectangular distribution is a family of probability distributions such that for each member of the family, all intervals of the same length on the distribution's support are equally probable. –  Ramhound Apr 26 '12 at 16:44

1 Answer 1

I think the answer depends on what type of class you're taking. This could be a time complexity problem (theoretical) or more practical.

In either case, here is what you know: you have a fairly large user population, each user has a unique salt, and anyone can read the salt and password hash for any user. You find a link to a benchmark of a large list of ciphers and hash functions here, which can be used as a guide to figure out how much data you can pump through a hash function. Without giving away too much, figure out what the purpose of adding a salt value provides in computing a hash.

Good luck.

share|improve this answer

Your Answer


