Irreversibly converting user-selected passwords into authentication tokens that can be safely stored e.g. in a user database. Typically done with a salted password-based key derivation function (PBKDF), ideally with a memory-hard mixing stage to thwart brute-force attacks using parallel hardware.
Password hashing is the process of converting a user-supplied (and often user-selected) password or passphrase into an authentication token that can be safely stored e.g. in a user account database, in such a way that the token can later be used to verify the correctness of the password.
The goal of password hashing is to prevent an attacker from learning the passwords even if they manage to gain access to the database (and to any other secret information used in the process). To achieve this goal, a good password hashing scheme should be:
- irreversible: there should not be any significantly easier way of finding a password that produces a given hash than by brute force guessing;
- unpredictable: it should not be feasible to speed up a brute force guessing attack by carrying out any precomputation before the hash is known;
- user-specific: testing a guessed password against one user's hash should reveal no information about whether any other users might have that password;
- slow: the process of testing a password against a hash should take as much time as legitimate users are willing to spend on it, in order to slow down brute force or dictionary guessing attacks; and
- expensive to parallelize: the hashing scheme should not be efficiently implementable on massively parallel computing hardware such as GPUs, FPGAs or ASICs, to prevent attackers from using such hardware to guess passwords quickly.
The irreversibility is normally accomplished by applying a cryptographic hash function to the password (hence the name password hashing). The unpredictability and user-specificity are normally accomplished by using a random "salt" string unique to each user, the slowness by iterating the hash function many (often thousands or millions) of times, and the resistance to parallel hardware attacks by making the iterated hashing process require a large amount of random-access memory.
These are essentially the same requirements as for deriving cryptographic keys from user-supplied passwords, which is why password hashing is commonly implemented using a password-based key derivation function (PBKDF).
- passwords: A generic tag for passwords and their use in cryptography.
- hash: Cryptographic hash functions, commonly used as the low-level building block for password hashing schemes.
- salt: A random unique per-user string used (and stored alongside the hashes for later verification) to thwart attacks based on precomputed tables and to prevent effective simultaneous guessing of many users' passwords.
- pbkdf: Password-based key derivation functions, often used for password hashing or password-based-encryption. Specific PBKDFs with their own tags include pbkdf-2, bcrypt, scrypt and argon2.
- memory-hard: Algorithms that are hard to parallelize because they (deliberately) require a large amount of random-access memory.