2
$\begingroup$

I am trying to understand how best practices on password hashing come about. With password hashing, I mean specifically for the case of storing user passwords in a database in a hashed representation, in order to compromise user passwords if an adversary gets access to the database. I understand that recommendations (especially algorithm, number of rounds, etc.) continue to change.

My question is, who would be authoritative sources on what is currently best practice, and where and how can I keep up to date?

Right now my process is that I notice someone saying something about best practice in a StackOverflow answer that does not fit my understanding, and then I start digging for more information. This seems backwards, and I'd like to get ahead on this thing.

Improve this question
$\endgroup$
1
  • 1
    $\begingroup$ I dont think there is an authoritative source, and best practice for password hashing has generally been insufficient, look at a widely used software package like Magento and see which password hash each version uses $\endgroup$
    – Richie Frame
    Jun 5, 2018 at 11:06

3 Answers 3

Reset to default
3
$\begingroup$

The best place to start is the password hashing competition. It was run by and had many entries by competent researchers. You don't make a mistake going with their recommendation.

If you are interested in ongoing discussion I suggest their mailing list.

Improve this answer
$\endgroup$
1
2
$\begingroup$

Best theory is some breed of Argon2, winner of the password hashing competition; and Balloon.

Best practice is what's available as a native library in the interpreted (thus not directly suitable for password hashing) language that ends up to be used. Modern ones (e.g. password_hash of PHP since version 7.2) have Argon2i, but few years ago that was rarely scrypt, sometime bcrypt, often PBKDF2-HMAC-somehash or a variation thereof. Password hashing not using sizable amount of memory, such as PBKDF2, was among the best in the 1990's, but offers poor resistance to determined password search using GPU or ASIC.

Improve this answer
$\endgroup$
6
  • 1
    $\begingroup$ Unfortunately not all languages come with a default function. I don't see one in Node.js, for example: nodejs.org/api/crypto.html --- pbkdf2 is the best choice with native support, and argon2 is available as packages, but there is no default password hash function that will follow best practice. $\endgroup$
    – Niels Abildgaard
    Jun 5, 2018 at 13:28
  • 1
    $\begingroup$ @Niels Abildgaard: the sad state of things is that every language reinvents the wheel and a crypto API. We end up with password hash (and ciphertext) formats that are largely bound to a language (or at least need a glue code for other than their native language) and thus great difficulty to move data from one language to the other, heterogeneity in how things are done across languages, language built-in features that lag compared to state of the art, and more bugs to fix. $\endgroup$
    – fgrieu ♦
    Jun 5, 2018 at 14:50
  • $\begingroup$ @NielsAbildgaard It's actually not "native" as in "standard library" that's important. It's "native" as in "native to the real world hardware". You possibly can write a Perl script implementation of bcrypt or something better. It might be compatible with the algorithm in terms of correct outputs for any given input. It won't run in an interpreter nearly as fast as the native implementation. (Probably at least 100 times slower.) That's bad because the goal isn't to make password hashing slow for you, it needs to be slow for other people too. $\endgroup$
    – Future Security
    Jun 5, 2018 at 18:20
  • $\begingroup$ @Future Security I understand the point you are making but I'm not sure what you are responding to :-D The Node.js implementation hooks into a C implementation so it should run quite fast, and is native in both senses: JS code (calls C binding): github.com/nodejs/node/blob/master/lib/internal/crypto/… | C code: github.com/nodejs/node/blob/master/src/… $\endgroup$
    – Niels Abildgaard
    Jun 5, 2018 at 18:44
  • $\begingroup$ @NielsAbildgaard If you've found something that fits both, then that's great. I don't know much about node.js. (I've heard that the world of computer security would probably have been better off without it. And I have anti-javascript bias. I've picked all the specific details about all the different node.js packages out of my crystal ball to make my life easier.) $\endgroup$
    – Future Security
    Jun 5, 2018 at 19:22
0
$\begingroup$

NIST, in their "technical requirements for federal agencies implementing digital identity services", recommend using PBKDF2 or Balloon to hash passwords: https://pages.nist.gov/800-63-3/sp800-63b.html#sec6

Improve this answer
$\endgroup$
3
  • $\begingroup$ Interesting that NIST recommends Ballon hashing instead of Argon2 or Scrypt, but without stated rationale. Anyone have inside information as to why? $\endgroup$
    – rmalayter
    Jun 5, 2018 at 13:38
  • 2
    $\begingroup$ I merely skimmed the part of the text around the word "balloon". The relevant sentence begins with "Examples of suitable key derivation functions include..." That doesn't imply the list is exhaustive. They're odd examples. PBKDF2 is definitely most flawed out of all acceptable algorithms. Balloon is one of the memory hard functions but it's the least well known. It's almost as if they're saying "anything reasonable is okay" but because they didn't say explicitly say so we don't know. $\endgroup$
    – Future Security
    Jun 5, 2018 at 18:59
  • 2
    $\begingroup$ I think the Balloon hashing paper, with its security proof and bonus attack on Argon2i had just come out while SP 800-63 was being updated. Recommending Argon2 at that time probably didn’t seem like a good idea. $\endgroup$
    – rmalayter
    Jun 7, 2018 at 3:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.