7 ms·

"The new Mt. Gox site features SHA-512 multi-iteration, triple salted hashing" Why not use a standard key derivation function such as PBKDF2 or bcrypt to provi

• daeken 15y ago
  The part that bothers me about that is "triple salted hashing". This could mean any number of things, all of which point to a misunderstanding of what a salt is for.
  • Joakal 15y ago
    Triple salted hashing sounds like either there's three salts in a hash or it's hashed with a salt three times.
    • seanalltogether 15y ago
      Perhaps they mean it's salted by 3 different environments, so an attacker would need to crack the db server and 3 other servers just to get a chance to start cracking the passwords.
      • daeken 15y ago
        That would mean that logins would have to go through 3 different servers. If anything, I would be more worried about security in that case.
        • gojomo 15y ago
          Not necessarily. Let's say the salt is a combination of a per-user salt in the database, a per-user salt from a file on disk, and a per-system salt that's entered at the console at startup and held in memory. A DB compromise doesn't reveal the other 2 salts. A full filesystem image doesn't reveal the third salt. Even an interactive root compromise would need to know to take an image of the running system's memory to get the third salt.
          • Jach 15y ago
            That's very clever. Though I doubt this is what Mt. Gox is actually doing...
            • owenmarshall 15y ago
              That idea is absolutely not clever. It's a system that would be difficult to implement, fragile, and most importantly would provide almost no added security. Programmers: shut the fuck up and use a well known password derivation function. Stop the NIH wanking -- homebrew cryptography is about as useful as seeing the local witch doctor for a heart attack.
          • uxp 15y ago
            Why reinvent the wheel using engineering techniques you only have cursory knowledge of from reading an encyclopedia? There is a standard method of securing online accounts, using known methods that are currently known to be perfectly safe in every application from financial institutions to the latest social networking site. Triple-salting passwords is not that method. http://codahale.com/how-to-safely-store-a-password/ http://codahale.com/how-to-safely-store-a-password/ http://chargen.matasano.com/chargen/2007/9/7/enough-with-the-rainbow-tables-what-you-need-to-know-about-s.html http://chargen.matasano.com/chargen/2007/9/7/enough-with-the...
            • gojomo 15y ago
              I wasn't advocating this method or defending Mt. Gox. (Their touting of SHA-512 and use of the unclear term 'triple salted' raises red flags.) I was providing an example of what could be meant by 'triple salting' that didn't necessarily involve 'three servers'. We could contrive scenarios where bcrypt with this multisource-salt would be a win over bcrypt with a single same-database salt. Intellectually exploring the problem and solution space requires more than just slavishly repeating the already widely-known 'standard methods'. Have we worked together at a level that would help you assess my level of knowledge, and the sources thereof? I don't recognize your name/handle.
              • 15y ago
    • Xk 15y ago
      That is indeed what it sounds like, but what's really worrisome about that is that anyone who thinks the solution to keeping passwords is to triple-salt them really needs to learn some things about keeping passwords safe. I could quintuple-salt my passwords with 4096 byte salts chosen purely randomly and there would be no perceivable advantage over a single 512 bit salt.
    • wiredfool 15y ago
      Triple salt sounds bad. Should be Salt, Pepper, and Cayenne.
  • rheide 15y ago
    How so? Seems to me like it could mean any number of things, all of which succeed in securely hashing+salting a password.
    • daeken 15y ago
      They could be using 3 different salts, each of which is statically stored on the server. They could be using 3 per-password salts, and applying each of them once. They could be.... At the end of the day, salts are there for one thing alone: eliminating the possibility of rainbow tables. But whether you use 1 salt of decent size (64-bit minimum for that) or 1000, you've got the exact same protection there. There's a good reason it's recommended that you use PBKDF2 or bcrypt.
      • eric-hu 15y ago
        Doesn't a salt just make a rainbow table attack more expensive, in direct relation to the length of the salt?
        • yaakov34 15y ago
          No, it doesn't. Once the salt is large enough that you don't have several passwords hashed with the same salt value, there is absolutely no further advantage. Frankly, 64 bits of salt seems like enough for anything. Triple-salting sounds like a technique made up by an amateur who doesn't understand what salting is supposed to do.
          • by 15y ago
            "The length of the randomly generated salt shall be at least 128 bits." nist-sp800-132.pdf http://csrc.nist.gov/publications/PubsSPs.html http://csrc.nist.gov/publications/PubsSPs.html Not quite the same application, but it would seem best to take a conservative approach and make your salts 128 bits because the storage required is so small - you are only storing one per username.
            • 15y ago
• spc476 15y ago
  Why not use client-side certificates to log in? Or at least use a client-side certificate for anyone that works at Mt. Gox.
• jsprinkles 15y ago
  What is the benefit of bcrypt over several million rounds of SHA-512? It seems to me that repeating the hash function is the adjustable work factor that bcrypt seeks to allow and SHA-2 is already in most languages without an additional library.
  • tedunangst 15y ago
    Not much. You are perhaps a little more likely to find super-tuned GPU/FPGA implementations of SHA2 than pessimized blowfish, but it's not inconceivable for someone to write the latter. bcrypt is easier to pronounce than PBKFD2.
  • idlewords 15y ago
    When talking about DIY crypto, the question should be turned around - what's the benefit of this over just using bcrypt?
    • pnathan 15y ago
      Well, one example might be if you were implementing your crypto in a language that doesn't have bcrypt bindings. So you would either have to port bcrypt or use existing crypto code to approximate bcrypt-level security.
      • maaku 15y ago
        False choice. Why roll your own when either porting bindings to bcrypt or porting the bcrypt implementation to your language is easier and safer?
  • Locke1689 15y ago
    No. Making Blowfish faster is equivalent to solving a hard cryptographic problem. We have a much weaker guarantee about SHA-512. While SHA is probably good enough, bcrypt is definitely better.
  • rmc 15y ago
    What is the benefit of bcrypt over several million rounds of SHA-512? Most advances in cracking cryptographic hashes is not from Moores law, but some insight or breakthrough in the underlying algorithm. i.e. someone figures out a way to make MD5 brute forcing 2^(lots) faster. Usually these are not done overnight, but are chipped away bit by bit. We are getting there with SHA512. The edges are starting to give. Warning signs are apparent. Eventually someone will reduce it to nothingness. 1000 iterations of nothingness is nothing ness. SHA-2 is already in most languages without an additional library. Oh dear god this is a terrible way to make a security decision. You have to install software no matter what you do. Unless you're writing software with a magnet in raw machine code, you will have to install additional software. Take the few minutes to install the bcrypt library.
• drivebyacct2 15y ago
  Yeah, when this very first happened, I was in the IRC room at onlyonetv interviewed Mark (via proxy). I kept shouting in IRC to ask them to use bcrypt and was told they were doing 1000xSHA-512. I later tweeted at MagicalTux to recommend bcrypt and was asked if multiple iterations of SHA-512 is good enough. He said that he was told bcrypt was not secure enough. How do these businesses succeed with business people that have no business wit about them, have NO ability to communicate effectively in these critical situations and have awful taste in technical advice? Google "bcrypt sha-512 hash passwords" and tell me if it's a hard call to make. You should have heard these guys within the first 36-hours answering questions. Even the business guy over at TradeHill, "Well, you know after mtgox, we need to do a lot to beef up our security". Even if that's a true statement, what a ridiculously terrible way to phrase it. I think speech and debate classes should be required for everyone to graduate highschool, let alone college. People aren't good at thinking on their feet and speaking in critical situations where wording makes a difference. When you're in the business of being an online bank for an uninsured (nearly) untraceable currency, mis-speaking like this costs you your most important asset: TRUST. That's not even touching the tip of the iceberg of lies and misinformation that has come out of mtgox. Anyone that leaves a penny in any mtgox account is an idiot.
  • puredemo 15y ago
    >How do these businesses succeed with business people that have no business wit about them, have NO ability to communicate effectively in these critical situations and have awful taste in technical advice? They take off because they are excellent, useful and timely ideas. Unfortunately, people who have strong, timely ideas, like this one, frequently aren't able to find good technical co-founders, probably because of the "ideas are worthless" meme so many hackers love to recite nowadays. So the ideas take off anyway, but the sites basically don't have the technical architecture that they should and have to be rewritten later.
    • alsocasey 15y ago
      Ideas are worthless refers to the fact that an obvious thing is obvious - I would argue that most ideas that go on to become successful products are obvious. Seldom are they really revolutionary. The implementation might be, but the idea itself seldom is. In the current case, well just because it isn't perfect from a technical standpoint, doesn't mean it wasn't the best execution of the idea out in the wild...
• bcl 15y ago
  1st rule of cryptography - don't try it at home. You'll get it wrong. There are any number of standard ways to protect passwords, there's no need for them to be reaching for the bottle of Snake Oil.
  • cvandyck76 15y ago
    Exactly. Security through obscurity does not work (for long, at least).
  • boyter 15y ago
    Rocky Heckman who is a security specialist as Microsoft http://blogs.msdn.com/b/rockyh/ http://blogs.msdn.com/b/rockyh/ summed it up in the best way I have heard so far. "Don’t write your own Crypto algorithms unless you have a Doctorate in Cryptography."
    • khafra 15y ago
      I think Thomas Ptacek takes it a necessary step further: "Don't implement crypto." Even if you're using a good algorithm, your implementation of it will have holes. The trouble is that the normal exploratory programming technique that gets a MVP up and running doesn't find security holes.