1
$\begingroup$

I have an application that I use sha3-512 to hash my password with a randomly generated 64 characters salt for each password. Is it bad to use this method to store passwords? I know many people reference using bcrypt for password storage. What are the advantages/disadvantages of using bcrypt vs. a hash/salt combo?

Improve this question
$\endgroup$
1
  • 2
    $\begingroup$ Don't roll your own crypto. It's nice that you adopted SHA-3 :), but still bcrypt would be much better and if you're willing to adopt new standards scrypt and the PHC-finalists may be worth a look. $\endgroup$
    – SEJPM
    Jun 2, 2015 at 16:58

1 Answer 1

Reset to default
4
$\begingroup$

Is it bad to use this method to store passwords?

Yes. It is bad.
Why?

  1. It's bad because you're rolling your own crypto, which is generally considered a bad choice.
  2. It's bad because SHA-3 is slow in software (e.g. on servers and consumer PCs) and fast in hardware (e.g. FPGAs, ASICs) and hence attackers can relatively fast try out many passwords.

So the disadvantages:

  • SHA-3/2 is fast and therefore an attacker can try many passwords very fast even though you're using a salt.
  • SHA-3 isn't widely deployed yet and availability of bcrypt/scrypt may be better.
  • SHA-3 is designed to be a good hash-function, not a good password-hashing-scheme (PHS), whereas bcrypt is designed to be a PHS and was analyzed in this direction as well.
  • Bcrypt is slower and requires some memory (4 kiB IIRC), so one spends 100ms to check a valid password whereas an attacker needs days / years to crack it because he's slowed down and can't use GPUs efficiently.

So all in all, always prefer bcrypt over standard (iterated) hash-functions.

You may also want to take a look at scrypt and the password-hashing competition (PHC). PHC is in the final phase and until winners are selected and deployed scrypt may be a better option - if you don't want to authenticate users on your server.

Improve this answer
$\endgroup$
2
  • 1
    $\begingroup$ Yes. In a nutshell, SHA3-512 has not work factor parameter, which is of paramount importance for password storage; and uses little RAM, which in this application is a drawback. $\endgroup$
    – fgrieu ♦
    Jun 2, 2015 at 17:51
  • 5
    $\begingroup$ I don't see how this could be considered rolling his own crypto. $\endgroup$
    – Andrew Hoffman
    Apr 17, 2016 at 17:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.