0
$\begingroup$

So this is my first post on this forum, so bear with me if I sound stupid. I am creating my own web application with JavaScript and MongoDB. I am storing all user information in a Mongo table, and currently this is the hashing algorithm I used to store the passwords:

function generatePassword(input) {
     return Buffer.from(crypto.createHash('sha256').update(input).digest('base32')).toString('hex').toUpperCase();
}

So, from what I recall from previous Cyber Security classes, sha256 has been long cracked, therefore deeming it insecure for storing passwords. I understand this being my web application I will not be experiencing security breaches, but I want to show that I have the awareness and knowledge to correctly and securely store the passwords. Therefore, I thought that if I changed up the code a little bit by using this:

function generatePass(input) {
     input = input + "455kjnr2902rug5348934";
     return Buffer.from(crypto.createHash('sha256').update(input).digest('base32')).toString('hex').toUpperCase();
}

I guess my questions are, is this

a. An effective salting method? If not, how would I go about salting the password? b. Is there a more secure way of doing this? Is this basically useless, or useful?

Thanks in advance to anyone who can help!

$\endgroup$
1
  • $\begingroup$ Why is the function called generatePass? Isn't the user supplying the password? $\endgroup$ – Aman Grewal Jan 18 at 20:52
2
$\begingroup$

Sha256 has not long been cracked, but it's not useful for human-generated passwords. You want a key stretching function. SubtleCrypto provides PBKDF2 (documentation), which is fine. Other libraries might support bcrypt, scrypt, or Argon2, any of which would be better.

Salts should be unique per user. This is so that when two users have the same password, the hashes will be different. This prevents a variety of attacks, like rainbow tables or looking at the frequency of hashes. Having a constant value appended to the password doesn't make these attacks any more difficult.

$\endgroup$
3
  • $\begingroup$ Thank you for your answer. $\endgroup$ – cardinalsfan13 Jan 18 at 21:07
  • 1
    $\begingroup$ Nitpick: the point of the salt is to make hashes unique even if two users pick the same password. That prevents quite a few more attacks than just rainbow tables. $\endgroup$ – SAI Peregrinus Jan 18 at 23:15
  • 1
    $\begingroup$ And I would suggest using a unique salt per password in case a user ever goes back to a previous password. $\endgroup$ – Swashbuckler Jan 19 at 0:59
0
$\begingroup$

Absolutely agree that you need unique salt per user and use a vetted algorithm such as PBKDF2, don't try to create your own no matter how simple it seems since you can easily add a iteration count to add time / complexity to an attack.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.