I have an application that I use sha3-512 to hash my password with a randomly generated 64 characters salt for each password. Is it bad to use this method to store passwords? I know many people reference using bcrypt for password storage. What are the advantages/disadvantages of using bcrypt vs. a hash/salt combo?
-
2$\begingroup$ Don't roll your own crypto. It's nice that you adopted SHA-3 :), but still bcrypt would be much better and if you're willing to adopt new standards scrypt and the PHC-finalists may be worth a look. $\endgroup$– SEJPMJun 2, 2015 at 16:58
1 Answer
Is it bad to use this method to store passwords?
Yes. It is bad.
Why?
- It's bad because you're rolling your own crypto, which is generally considered a bad choice.
- It's bad because SHA-3 is slow in software (e.g. on servers and consumer PCs) and fast in hardware (e.g. FPGAs, ASICs) and hence attackers can relatively fast try out many passwords.
So the disadvantages:
- SHA-3/2 is fast and therefore an attacker can try many passwords very fast even though you're using a salt.
- SHA-3 isn't widely deployed yet and availability of bcrypt/scrypt may be better.
- SHA-3 is designed to be a good hash-function, not a good password-hashing-scheme (PHS), whereas bcrypt is designed to be a PHS and was analyzed in this direction as well.
- Bcrypt is slower and requires some memory (4 kiB IIRC), so one spends 100ms to check a valid password whereas an attacker needs days / years to crack it because he's slowed down and can't use GPUs efficiently.
So all in all, always prefer bcrypt over standard (iterated) hash-functions.
You may also want to take a look at scrypt and the password-hashing competition (PHC). PHC is in the final phase and until winners are selected and deployed scrypt may be a better option - if you don't want to authenticate users on your server.
-
1$\begingroup$ Yes. In a nutshell, SHA3-512 has not work factor parameter, which is of paramount importance for password storage; and uses little RAM, which in this application is a drawback. $\endgroup$– fgrieu ♦Jun 2, 2015 at 17:51
-
5$\begingroup$ I don't see how this could be considered rolling his own crypto. $\endgroup$ Apr 17, 2016 at 17:25