Re: Hash MD5, Sha1 and Length

Tech-Archive recommends: Repair Windows Errors & Optimize Windows Performance

On Thu, 17 Sep 2009 04:32:37 -0700 (PDT), shapper <mdmoura@xxxxxxxxx>
wrote:

On Sep 16, 8:19 pm, rossum <rossu...@xxxxxxxxxxxx> wrote:
Password lengths should be specified in either company policy or user
instructions.  Six or eight characters is a minimum with a maximum of
fifteen or twenty for passwords or 100 for passphrases.  You may also
want to enforce the use of mixed case, digits and non-alphanum
characters.

When you say passphrases you mean that when using passwords a space
shouldn't be allowed?
Yes, a password has no spaces while a passphrase may do so.
Passphrases are usually longer, which should make them more secure.

I am just wondering if I should include that in validation of the
form.
If there are rules for a correctly formed password/phrase then those
rules should be enforced.

rossum


I do think that you should stay with a fixed length salt.  If not then
the minumum length is 8 bytes (64 bits) and the maximum 32 bytes (256
bits)

Yes yes I will keep salt a fixed length. I was just wondering the
minimum and maximum size of passwords and salt also to be able to
define a proper length on the SQL table columns.

Thank You,
Miguel

.

Relevant Pages

  • Re: Hash MD5, Sha1 and Length
    ... characters. ... When you say passphrases you mean that when using passwords a space ... Yes yes I will keep salt a fixed length. ...
    (microsoft.public.dotnet.languages.csharp)
  • Re: Password alternatives
    ... Unlike passwords, biometrics do have the problem of False Accept Rate ... As for tokens, AFAIK they rely on ... passphrases as a string of characters, ...
    (Security-Basics)
  • Re: Reasons and examples for security
    ... A phrase like "the four brown cows jump" will take on the order of hundreds ... agree that long passphrases are the future, ... > otherwise compromised passwords by invalidating them. ... >> I am looking for examples to support my case for tighter security. ...
    (microsoft.public.security)
  • Re: Passwords: length vs. complexity
    ... Rather 90-95 (62 alphanumeric characters plus a number of special ... If we're talking about strong passwords, ... They're just not as secure as the proponents of passphrases make it ... enforces complexity requirements that are standard in Windows (three ...
    (Security-Basics)
  • Re: Password generator?
    ... Try teaching your users using "passphrases" - sentences that are actual passwords - using all kinds of characters like,.#! ...
    (microsoft.public.security)