3
$\begingroup$

I am using a KDF to derive a key, p' from a password p. I would like to know if the password is correct before using the derived key.

Bruce Schneier's PasswordSafe format V3 has

H(P') is SHA-256(P'), and is used to verify that the user has the correct passphrase.

I understand that bcrypt uses the derived key with Blowfish to encrypt "OrpheanBeholderScryDoubt" 64 times to create a password hash. (edit: I am not concerned specifically about Blowfish, but about any block cipher used in this manner. Bcrypt is just an example.)

Question:

Is there any difference in the security of these two approaches to verifying a password?

Context:

I want to be able to authenticate a user before giving him access to his account. Most of the account metadata are also encrypted with p' to protect them from disclosure to third parties.

Edit: Further research

The SHA-2 functions are based on the Merkle–Damgård construction, which is a method of creating a hash from a block cipher. Merkle–Damgård is popular because it provably preserves specific security properties of the underlying block cipher. It does have well-known weaknesses, with some known "strengthening" strategies (used in SHA-2). The main focus of the SHA-3 competition was to find a different construction without these weaknesses.

I have not been able to find any similar security proofs of the construction of bcrypt, but I also have not been able to find any attacks against it. No one seems to be using bcrypt for any purpose other than hashing/verifying passwords.

For the purpose of a password vault, as used by the PasswordSafe V3 format, the verification of the derived key is not strictly necessary. In the V1 and V2 formats was necessary because the data had no MAC. Of course, current best practice suggests that all encryption be authenticated. Colin Percival (author of scrypt) suggests verifying the MAC before passing attacker-controlled data to ANY complicated piece of code, such as an encryption or compression function, even when such protection does not provide any cryptographic security benefit.

Improve this question
$\endgroup$

1 Answer 1

Reset to default
1
$\begingroup$

It is important to make sure that password based key derivation takes place before passphrase correctness is checked. Otherwise, possible attacker can choose if they attack against passphrase correctness check or pbkdf function. (Appears ok on the both functions.)

  • PasswordSafe

    In case of very high entropy key, it theoretically could be possible that for instance SHA-256(P') would be easier to break than the key. However, for any typical passwords, expected amount of entropy is (possibly) between 10 and 80 bits, and thus the passwords are likely weaker than the hash. (Thus appears ok.)

  • bcrypt

    I don't like decision to use blowfish encryption in crypt. This is because cryptographic key should usually be used only for very small (preferably one) purpose. The use in blowfish algorithm "consumes" allowed key uses. Maybe blowfish is the weakest link?

Overall, it seems that both choices should appear good enough for common practice, but I think the PasswordSafe's choice of SHA-256 appears even more conservative and secure. However, using SHA-256 appears extraneous as well.

Improve this answer
$\endgroup$
3
  • $\begingroup$ Commenting my own reply: there favouring and very good comment on security of bcrypt at security.stackexchange.com/questions/4781/… - see the first comment from Thomas Ponin. My opinion generally is that bcrypt is between PBKDF2 and script. If I want memory hard, I go with script. If I want well vetted and approved solution I go with PBKDF2. Many seem to recommend bcrypt if you want to compromise between memory use, how old algorithm is and how it works. bcrypt seems to have many favoring comments and analysis unlike PSafe $\endgroup$
    – user4982
    Commented Sep 27, 2013 at 17:59
  • $\begingroup$ Yes, the KDF is run first. I am assuming that entropy(p)>80 bits (diceware). Is there a known preimage attack on SHA256 (full rounds) that is better than brute force? $\endgroup$
    – Terrel Shumway
    Commented Sep 27, 2013 at 18:36
  • $\begingroup$ @Teris: Wikipedia has information on hashes including various sorts of attacks at page: en.wikipedia.org/wiki/Cryptographic_hash_function. Currently there is no stronger attack known on full SHA256. Then again, attacks always get better, they never get worse, so eventually things may change. $\endgroup$
    – user4982
    Commented Sep 27, 2013 at 18:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.