I have been tasked with putting a simple sign in experience in place where the user types in their ID and a 5 to 8 numeric value as the password or PIN as it is called here.
I am using ASP .NET Core and using Identity Server 4 as the core implementation for issuing tokens. I have to implement the login page and know the requirements to make a secure page/cloud system.
From my research, Bcrypt is the defacto hashing mechanism to use to perform this task, but I have a couple of concerns:
- That if/when as they say in the security industry the system is compromised, with such a short PIN, even if we use a large salt, it will be very easy to calculate all of the PINs as there is technically only a small number of outcomes compared to free text passwords.
- There is not a verified implementation of Bcrypt in .NET - ASP.NET Core uses PBKDF2 and as it is part of the framework, so with that I think I gains credibility here.
My default answer in these situations is to use Auth0/Azure AD B2C or some other huge company who does this stuff day to day and enforce complex passwords but the requirement is very specific and cannot be fulfilled by the operators out there.
I have done a risk analysis around this and presented it to the business which they accept, but the niggling questions here are:
- is there anything more modern than PBKDF2 and verified that I should be using?
- Are my concerns valid that the the passwords will be easy to crack if the systems data stored are compromised?
- What auditing mechanisms would you recommend in a system like this?