2
$\begingroup$

I'm doing a password manager for a school project and I need to hash the master password for verification but I also need to write the hashing algorithm myself. However, most the algorithms I've come across are very complicated (except for MD5 but that's overly insecure). Are there any slightly simpler hashing alogorithms which won't take too long to write and implement without libraries? (I'm using c#).

$\endgroup$
  • 1
    $\begingroup$ Are you sure you are not supposed just to write the password hashing algorithm yourself? A password hashing algorithm takes a salt and work factor or iteration count as input. If it uses a cryptographic hash function then it is just used as configuration parameter. As such, password hashing algorithms are much easier to implement given an existing cryptographic hash (although, as always, the devil is in the details). $\endgroup$ – Maarten Bodewes May 16 at 11:03
  • $\begingroup$ @MaartenBodewes Well my project is to create a password manager and I want to do as much of it myself for extra marks. So I guess I need to do the password hashing algorithm myself as well as the cryptographic hash. $\endgroup$ – Chickenator May 16 at 15:53
  • $\begingroup$ @Chickenator if you are writing 64-bit code, Keccak is surprisingly easy to do thanks to its simplicity $\endgroup$ – Richie Frame May 17 at 0:27
  • 4
    $\begingroup$ I'd strongly advice you to first get it working (with an existing crypto hash and password hash) and then implement the hash functions themselves if time permits. $\endgroup$ – Maarten Bodewes May 17 at 4:17
4
$\begingroup$

The PBKDF2 construction is simple to implement, and can be implemented with any underlying hash function.

Unlike modern password hash functions, the end result will be computationally intensive, but won't have any resistance against parallelization. Not requiring much memory means that ASICs can efficiently brute-force passwords hashed that way.

$\endgroup$
2
$\begingroup$

Balloon hashing is nearly as simple to implement as PBKDF2 and is a memory-hard password hash (like Argon2 or scrypt). Balloon is also specifically recommended as a memory-hard password hash in the latest revision of NIST SP-800-63B so that might net some extra consideration from your instructors if this is an applied crypto class. (Dealing with compliance and standards is an important part of real-world cryptography practice).

Balloon is defined for any cryptographic hash function, so you can implement with C#’s included SHA256 and then implement SHA256 itself if time permits.

Pay careful attention to making constant-time comparisons of secret-derived data (such as when verifying the master password). I suspect this is what your instructor really wants to see. Also zero secrets from memory as quickly as possible after they are used.

$\endgroup$
  • $\begingroup$ The precise wording is "Examples of suitable key derivation functions include [PBKDF2] and [Balloon hashing]." I interpreted it to mean "Anything reasonable password hash from A to Z is okay to use." I think prior to 2017 PBKDF2 was the only recommended or permissible algorithm. Best practice went against NIST recommendations for a long time before this document. The only good reason I could come up with for why they would use that phrasing and those particular examples was in response to that. $\endgroup$ – Future Security Jul 14 at 17:43
  • $\begingroup$ @Future_Security True it is a “weak reference”. But try explaining to a bank auditor that you chose a hash not explicitly in SP 800-63B. These are the same folks that insisted on ridiculous 90-day password rotations for no other reason than it was suggested in the previous version of the same document. They would fail an audit and call breach on a contract over that detail. “Best practice” and government regulation are seldom in agreement. $\endgroup$ – rmalayter Jul 15 at 3:19
  • $\begingroup$ Eh. I don't think a bank would bother with fighting an auditor over a technological decision like that, even if they knew better. The cost of their risky decisions is heavily externalized and it's worth it to them to treat the losses they do take as a cost of doing business. Pins, credit card numbers, security numbers, security questions, and handwritten signatures aren't really part of great authentication measures. I'm more concerned with how much trust un-audited developers assign to NIST's recommendations. $\endgroup$ – Future Security Jul 15 at 4:28
  • $\begingroup$ Balloon hashing is a good choice for a school project, of course. Especially if it's an undergrad CS project. Optimized Argon2 is preferable for real world use for many applications (because Balloon hashing isn't tuned to real world hardware), but implementing it would be a project on its own and wouldn't be a good exercise to add on top of another complex task. $\endgroup$ – Future Security Jul 15 at 5:01
1
$\begingroup$

except for MD5 but that's overly insecure

So MD5 would be fine if it was secure? The reason MD5 is considered insecure is because it is highly vulnerable to collision attacks, which involve creating two differing inputs that have the same hash. The only attack that would be relevant to password hashing is a preimage attack, and MD5 is not vulnerable to these. So why is MD5 (and even SHA-1 and SHA-2) not safe to use to hash passwords? Simple: It's too fast. A fast GPU can try literally billions of candidate passwords per second.

Luckily for you, it is possible to slow down MD5! There are several different constructions which can do this, the most popular being PBKDF2. However there are even more simple constructions. The S2K KDF from the OpenPGP standard is by far one of the most simple password hashing algorithms which uses a fast hash. All it involves is passing a repetition of the password and a salt through the fast hash function until several tens or hundreds of megabytes have been processed.

Note that even though this will be more secure than a plain hash, you still shouldn't use this for anything more than a toy project. S2K is not memory-hard, which means an attacker can use massive parallelism to their advantage. Memory-hard KDFs like Argon2 are not nearly as easy to implement.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.