Hash Truncation

[dashawn888]

What do you guys think about truncating the hash for reduced value to anyone obtaining the pbkdf2 hash? If you think this is valuable I don't mind submitting a patch.

The idea being that if you truncate the hash you make it much harder to brute force the hash without having tons of false positive passwords.

IE. Smaller just to save space
pbkdf2("password") = f1ca f3c0 67db 8563
vs
pbkdf2("password") = f1ca f3c0 .truncated.

Choose the truncation length so that it's plenty of data to make false positives from the user 1/1,000,000,000 but make a brute forcing attempt come up with 1,000,000,000 of possible valid passwords and modification to existing password cracking algorithms?

Thanks,

Shawn

[carbureted]

I think this is a good idea and am down to implement it - any starting points for the truncation amount you would suggest?

[dashawn888]

I'm not a mathematician or cryptographer so I'll do the same thing I always do and write tests. I have tests running that are looking for how many bits of hash are necessary to remove massive amounts of legitimate words from triggering a match.

Here is my test to determine a best guess at how many bits of hash to keep.
https://colab.research.google.com/drive/1xbUeVx8EmiE06grKaiomSU3Ah4l1nw2a?usp=sharing

[dashawn888]

My testing is showing 50 bits of hash is the minimal I was able to use without false positives from 25,487,000 word tests. The way the test works is it uses an English word list of 25,487 words and runs through the words 1,000 times. For each iteration it uses a new random salt.

Failed with word fulminate. Increasing Truncation to 43
Failed with word dragnet. Increasing Truncation to 44
Failed with word corduroy. Increasing Truncation to 45
Failed with word cohesion. Increasing Truncation to 46
Failed with word scythe. Increasing Truncation to 47
Failed with word Becky. Increasing Truncation to 48
Failed with word hurty. Increasing Truncation to 49
Failed with word Hieronymus. Increasing Truncation to 50
Final truncation without false positives is 50

[dashawn888]

So it looks like 50 bits gets me past 25 million tests without a collision. 57 bits gets me past 250 million tests without a collision.