2
$\begingroup$

I am working on some programs that require the users to store their passwords in my databases.

However, due to the fact that I am not sure whether salt should be stored in databases due to my approach:

(1. I am able to create a random string with the help of ASCII table)

(2. I am able to create a unique ID like a random string similar to the User's UUID under Google Firebase)

Here's my approach, the users are required to enter a "Security_String".

The allowed format only employs numbers from 1 to 5.

1 represents SHA-1

2 represents SHA-224

3 represents SHA-256

4 represents SHA-384

5 represents SHA-512

After I collect both Security_String and Password from the users, then Password undergoes a series of hashing loops based on the Security_String.

In this case, will the generated hashed password be considered safe enough? Or is it better to generate a hash password with salt by using my approach?

Also, is it better if I add another spicy ingredient called pepper during the hashing process?

Improve this question
$\endgroup$
1
  • 3
    $\begingroup$ Is there is reason that you are not using a standard approach like Argon2. A library mentioned here. $\endgroup$
    – kelalaka
    Mar 12, 2020 at 15:07

1 Answer 1

Reset to default
3
$\begingroup$

Generally you don't want to switch algorithms in cryptography. You'd have to deal with different workloads. Furthermore, the choice of algorithm would be just another salt, if a tiny one. However, your approach doesn't disallow the building of 5 separate rainbow tables. So the reason for a salt isn't met.

It is unclear why you would not be able to use a general Password Based Key Derivation Function (PBKDF) / password hash. So yes, using a well known good scheme with a a salt is indeed more secure.

A pepper can certainly be helpful; if the DB is stolen minus the pepper then it will be next to impossible for an adversary to start guessing passwords without the pepper. Of course the pepper should then not be kept in the DB, because that would negate the whole idea.

Improve this answer
$\endgroup$
3
  • $\begingroup$ Well to be honest, I am quite new in cryptography, I am actually an intern/practical student who is a self learner as college didn't taught me about hashing, encryption and stuffs like that, what they did is just cover some basics and let us explore... So the materials I have access to is quite few, hoping that could explain your question. $\endgroup$
    – Hern
    Mar 12, 2020 at 23:47
  • $\begingroup$ Well, that's fine, as long as they review what you come up with. Generally you can ask even after the course. Otherwise you will of course come up with stuff that isn't quite right - anybody would. $\endgroup$
    – Maarten Bodewes ♦
    Mar 12, 2020 at 23:53
  • $\begingroup$ In this kind of approach let's say if both salts and pepper were used, will it be better to put a maximum length of the security_string ? Or it's better to not have a maximum length but have a minimum length instead? $\endgroup$
    – Hern
    Mar 13, 2020 at 1:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.