1
$\begingroup$

The password is entered by the user and the key is processed locally. Neither the password nor the key will be stored, only used and forgotten (but hopefully not by the user). Is SHA256 by itself strong enough for this purpose? Do I really need a salt in this case?

I've looked around Google and other StackExchange questions, but they all assume the password and/or key will be stored. In any other case it probably would be stored, though my case calls for using it and forgetting it.

$\endgroup$
  • $\begingroup$ You need a salt and a good key derivation function like scrypt, bcrypt or PBKDF2. $\endgroup$ – Nova Apr 10 '15 at 11:44
1
$\begingroup$

Using simply a hash function is not strong enough, even if the key is not stored. We the users tend to choose very crappy passwords, such as "1234" or "password". If you only use a hash function for generating the key, then there are a lot of chances that the generated keys are SHA256("1234") or SHA256("password"). That is, this method is very vulnerable to brute-force attacks. An attacker could simply hash common passwords, similarly to a dictionary attack.

It is also possible to perform brute-force attacks on established key derivation methods, such as PBKDF2 and scrypt, but the probability of success is extremely small. These methods are specifically designed for this, for example by using a salt value (in order to prevent dictionary attacks) and a lot of iterations of the hash function (in order to slow brute-force attacks).

$\endgroup$
  • $\begingroup$ maybe add a reference to this, in case the asking person will have the two months. (PHC winners will be selected within the next two months) $\endgroup$ – SEJPM Apr 10 '15 at 11:49
  • $\begingroup$ Salt is usually there to prevent rainbow tables not dictionary attacks. Rainbow tables are of course not applicable in this context at all. $\endgroup$ – Artjom B. Apr 10 '15 at 12:14
  • $\begingroup$ @ArtjomB. They also help to prevent attacks if the same key is used by two different users. $\endgroup$ – Nova Apr 10 '15 at 14:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.