Questions tagged [password-hashing]

Irreversibly converting user-selected passwords into authentication tokens that can be safely stored e.g. in a user database. Typically done with a salted password-based key derivation function (PBKDF), ideally with a memory-hard mixing stage to thwart brute-force attacks using parallel hardware.

Filter by
Sorted by
Tagged with
48
votes
11answers
16k views

How do hashes really ensure uniqueness?

This might seem an impractical and unnecessary conversation, but I feel it's something I need to clarify. Especially, as I just got my first developer job in a blockchain startup. So hashes are said ...
31
votes
1answer
9k views

Why use argon2i or argon2d if argon2id exists?

So I am currently working on a GitHub project of mine and I want to implement Argon2. The problem is that I dont really know a lot about it. Internet research is not really helpful, because Argon2 is ...
24
votes
2answers
5k views

Does the Balloon hashing paper deprecate Argon2?

Does the recent Balloon hashing paper and the included attack on Argon2 effectively negate the result of the Password Hashing Competition? On one hand it seems that only a constant-factor improvement ...
19
votes
3answers
9k views

What is the recommended number of iterations for Argon2?

I've recompiled my operating system ("LionBSD" based on FreeBSD) to use Argon2i as the default password hashing algorithm in crypt/libcrypt. I'm wondering what the recommended number of iterations ...
17
votes
3answers
10k views

What password hash function for the next 50 years?

According to this report : http://www.ecrypt.eu.org/csa/documents/D5.4-FinalAlgKeySizeProt.pdf SHA2-512, SHA3-512, Whirlpool and Blake2b are hash functions that could be safe for the next 50 years. ...
17
votes
3answers
5k views

Should you change salt when changing password?

Assume a password storage scheme using a computationally-expensive hash algorithm and a CSPRNG salt. User ID, salt, and hash value are stored in a table; if the table is compromised, all three ...
16
votes
3answers
2k views

Why did Argon2 win the PHC?

I've been reading up on Argon2 (and, to a lesser extent, other recent password hashers). I'm trying to understand why it won the competition versus the other finalists, like Catena, Lyra2, Makwa or ...
15
votes
2answers
3k views

Mixing algorithms for password hashing good or bad?

So I've come across the following algorithm for hashing passwords ...
15
votes
2answers
2k views

Password hash that can be upgraded without plaintext password

Most password hashes have a cost parameter that indicates how long the algorithm should take. Is there an algorithm where you can increase that cost for a particular hash, without access to the ...
15
votes
4answers
2k views

How is the quality of a password calculated and what does it mean?

While using Keepass and using it to generate random passwords, I always have noticed the "quality" section but truthfully have never known what it actually means. So my questions are; How much ...
13
votes
3answers
1k views

Password entropy much lower than entropy of encryption keys. Why is this acceptable?

When talking symmetric encryption, a 56 bit key is known to be so weak. If you use it for your encryption, you are considered a goner. When talking passwords however, the standard these days is ...
13
votes
3answers
755 views

Is it better to maximize memory usage or number of passes with Argon2i 1.3?

I wrote a small application that uses Argon2i for deriving symmetric keys for encryption of local files and secret Curve25519 keys. Argon2i v1.3 is susceptible to TMTO attacks if the number of passes ...
11
votes
1answer
1k views

Does a big salt have the same memory effects as Bcrypt?

Citing Thomas Pornin on the question Why can't one implement bcrypt in Cuda?: bcrypt is a variant of the Blowfish key scheduling, which is defined over a table (a few kilobytes) which is constantly ...
10
votes
2answers
10k views

Storing Parameters In Argon2 Hash As Potential Security Issue?

I'm really trying to make sure that I follow best practices when it comes to password storage, and after some looking around for a good algorithm, I found that Argon2 was the "next big thing". I've ...
9
votes
1answer
10k views

Why do we use hex output for hash functions?

Why do we use hex representation as default for the output of a hash functions result? For example the sha256 hash function: the output of sha256 in hex representation uses 64 characters, while ...
9
votes
3answers
1k views

Cryptocurrency serving as hash breaking?

There are many people mining for Bitcoin right this second.[Citation needed] Bitcoin's proof-of-work mining system is based on a hash function (SHA-256, I believe), and there are ASICs built ...
9
votes
2answers
434 views

What math makes it safe to offer a stolen-password check service?

The database provider HIBP has 4 billion stolen passwords, and wishes to offer an API for websites to use during new-user signup (and password change) operations, so they can refuse to allow users to ...
9
votes
2answers
1k views

Best password hashing strategy with Argon2 in a web app

What are reasonable parameters for Argon2 to hash passwords in a web application? On the one hand we need good performance, fast responses and DDoS resistance, but on the other hand we need protection ...
8
votes
1answer
253 views

When to use Argon2i vs Argon2d vs Argon2id?

I've read the manual, and multiple articles / StackExchange posts about this topic, but still can't decide which implementation of Argon2 is best for my use case. I want to securely encrypt passwords ...
7
votes
2answers
3k views

Whats the deal with argon2?

So I recently read an article about the Argon2 hash function. Now some Questions: I heard that it was developed in 2015 so why is it not implemented yet? If so where is it implemented? ( I think I ...
7
votes
1answer
321 views

Are coprocessors (Intel Phi) a threat for modern key stretching functions?

Modern key stretching functions (password-based key derivation functions, also used for password hashing) are memory-hard to mitigate parallel attacks, and as far as I know this is working well. Last ...
6
votes
2answers
2k views

Why is PerfectForwardSecrecy considered OK, when it has same defects as salt-less password hashing?

PFS suites suffer from the same defects as any other salt-less password hashing scheme. Why is everyone promoting Perfect Forward Secrecy (PFS) ciphersuites so fiercely? Namely, when the group/hash ...
6
votes
2answers
1k views

Argon2 for both password storage and key derivation

Is using Argon2 for both password storage and key derivation secure? I'm planning on using different salt values, of course. The basic concept is something like this: Alice has some secret data ($...
6
votes
1answer
3k views

Is PBKDF2/RFC 2898 broken because SHA1 is broken?

I was attempting to re-implement the ASP.NET Identity password hash algorithm in PHP. It uses RFC 2898, which uses HMAC SHA1. SHA1 has been broken by google. Does this mean that RFC 2898 in general ...
6
votes
2answers
328 views

Are there any high level memory-hard PBKDF constructions?

The PBKDF2 construction from PKCS #5 v2 has the convenient feature that it can be implemented using only standard interchangeable cryptographic primitives. Specifically, it only requires the ...
6
votes
1answer
2k views

How to configure Argon2d for commodity hardware?

You may already have heard it: KeePass v2.35 has support for a new database format (KDBX4) which allows for the use of Argon2 (more precisely: Argon2d) as the password-based key derivation function (...
6
votes
1answer
300 views

What is the role played by cache misses in memory-hard password hashing?

I experiment with argon2 and build a web application. In browser, I use one threaded hashing with not too much memory. I want to protect my short length input data from parallel brute-force attack. I ...
5
votes
2answers
2k views

Is the SHA1 hash of MD5 hash of a password secure?

Cryptography is not my area, so pardon me if the question is annoying. Some time ago, I implemented an Internet site, which database had a users table. To keep the password in its user table field, I ...
5
votes
1answer
2k views

Do I need to use a CSPRNG when creating salts for user accounts?

I'm not sure about the need of using CSPRNG to create salts for each user account. I found “Cryptographically Secure Pseudo-Random Number Generator in Qt/C++ (Cross platform)” (at StackOverflow) with ...
5
votes
1answer
374 views

Upgrade password hash in an existing system: Pbkdf2( salt , OldSha1Hash )

Background [Updated] Consider a situation where a website was created over a decade ago and user account password storage was done by storing SHA1(password) into ...
5
votes
1answer
231 views

Is It Safe to Reuse the Same Salt in Bcrypt Password Hash (Specifically for Chaining Hashes)

As explained in my previous question, I want to develop a scheme which would be able to increase the password hash strength without the user password. According to Thomas Pornin it should be safe to ...
5
votes
2answers
337 views

Password derived hash to encrypt known plaintext as password check

The title sounds way too adventurous for what it actually is. I am currently building a system which features some encryption. There is already a system in place, which is built after that scheme if ...
5
votes
1answer
303 views

How does blockmix in scrypt work? What is the meaning of the H function in scrypt?

I am trying to understand how scrypt works. I am referring to the Algorithm section of scrypt's Wikipedia page. There I find ...
5
votes
0answers
80 views

How would quantum computers affect password based encryption?

At first glance: Assuming that the output of the password hashing function is large enough, quantum computers should have no effect on password encryption as on symmetric cryptography in general. Is ...
5
votes
0answers
506 views

Argon2 - memory setting - lower bound?

(I realise this is yet another Argon2 "how do I configure" question, but the existing questions I've found don't really help. If I've missed one, happy to have this closed). Deploying Argon2 (with ...
4
votes
4answers
951 views

Rehashing PBKDF2 hashes - do iterations stack?

Let's suppose I have a bunch of PBKDF2 hashes in a database. For the sake of keeping this simple, let's say I've used 10 iterations. A few years later I decide to upgrade to 20 iterations. I want to ...
4
votes
1answer
3k views

Pre-image attack on MD5 hash

I read somewhere MD5 is broken in terms of collision, but I am wondering if it is broken in terms of pre-image resistance? Given a hash of Md5, is it possible to find the original message of it? If ...
4
votes
1answer
5k views

Traditional DES scheme in Unix crypt function

In a security context course, we need to reproduce the old DES hashing scheme in the crypt program, on an old unix system. I am actually reading the crypt page on wikipedia: The traditional ...
4
votes
2answers
402 views

How secure are public hashed passwords (with a salt)?

I'm working on a blockchain-based distributed application which stores Client information. I'm thinking of alternate ways to authenticate ...
4
votes
1answer
307 views

Why derive keys from a master key instead of generating random keys?

I noticed AWS KMS generates encryption keys based off of a master key, using a key derivation function (HKDF). What's the practical advantage of deriving keys based on a master key? Isn't it simpler ...
4
votes
1answer
105 views

Ciphering the output of a password hash

In an article on password hashing security, Anthony Ferrara suggests using bcrypt to hash passwords and then using a "strong cipher (AES-128-CBC) with a key rotation policy". This seems like a good ...
4
votes
1answer
4k views

RAR brute force cracking speed

I have been playing around with cRARk and was astonished by the low speed. On a 2015 high-end GPU (GeForce 980 ti), it took roughly 4h 50min to test all passwords composed of an 8-character prefix and ...
4
votes
0answers
81 views

Upgrading key derivation by adding a XOR with a known value

In general keys for password based key derivation are derived from a password hash such as the old PBKDF2 function or Argon2, possibly followed by another derivation function to derive data and ...
4
votes
0answers
491 views

Password hashing in embedded systems

Are there good options for password hashing in embedded systems? These systems often cannot afford slow hash functions. I can think of a few approaches: Store the (hashed) passwords in a HSM that ...
3
votes
6answers
901 views

How does a salt get chosen?

I feel like I am missing some information regarding salting. How does one choose the salt? If you reuse the same salt for all passwords, can it just be figured out and then used in conjunction with ...
3
votes
2answers
514 views

The logic of preferring PBKDF2 over iterative SHA2

I have studied PBKDF2 for the application of hashing passwords, and frankly I don't understand the justification for the complexity of PBKDF2 over iterative hashing with a cryptographic hash function. ...
3
votes
4answers
267 views

How many bits of entropy are leaked for every derived password from a master?

Given a master password that has a lot of entropy (similar to Bitcoin HD wallet seed words, 130 bits of entropy or more) how many bits of entropy are lost per leaked generated password? Let's take an ...
3
votes
2answers
176 views

PBKDF2 with longer than native output length - Will hashing the result help?

I've seen it mentioned more than once that PBKDF2 should not be used to create a longer key than the native output (such as 160 bits when used with HMACSHA1). Since an attacker could test only the ...
3
votes
1answer
572 views

Why do different applications of hash functions demand different properties of the hash function?

A strong cryptographic hash function in general must guarantee several properties, including: Preimage resistance, second preimage resistance and collision resistance. It turns out, however, that ...
3
votes
2answers
375 views

How difficult is it to guess a salt based on a hash and known plain text?

I have the following use case: Alice owns the domain alice.com and Bob owns bob.com. I want to users to create a hash for ...