3 ms·

Agreed to the first sentence. Let's say you have a table full of SHA-1 salted + hashed passwords, is even remotely worth the effort to spend even 1k per user/pe

Agreed to the first sentence. Let's say you have a table full of SHA-1 salted + hashed passwords, is even remotely worth the effort to spend even 1k per user/per password? Especially when many (though obviously not all) may be using unique passwords (such as myself)? Even if they use the same passwords for all sites, that is an incredibly large hill to climb... Oh uh, to be clear, you should NOT be using SHA-1 right now. If you are reading this in order to justify not moving to a stronger hashing algorithm, none of us give you permission to do this, and if you get caught, any of us involved will vote for hanging you...with a noose...in a good old western style hanging...or something. Seriously. Don't use SHA-1. Move on. If you are a manager and a developer tells you that you can't move on, please reach out. I've (regretfully) moved many from SHA1 -> SHA-XXX and I've provided migration paths. Migration paths with accessibility mind you...though that apparently doesn't matter to many of you cough Citibank cough.

tptacek 5y ago
SHA-XXX is also not an acceptable password hash.
- CamperBob2 5y ago
  Why not?
  - throwaway787544 5y ago
    Because a password hash should be based on a KDF and SHA hash algorithms aren't. https://en.m.wikipedia.org/wiki/Key_derivation_function https://en.m.wikipedia.org/wiki/Key_derivation_function
  - rocqua 5y ago
    Because it is fast. Password hashing is better a slow function to compute. Delaying login by e.g. 0.001s (say 1000 times slower than normal) is unnoticeable, and login is rare enough that the total compute impact is quite low. But for a brute force attack a 1000 times slowdown is horrible. Even if specialized hardware makes it only 10 times slower it might still be effective. KDFs try to be slow, and they try to be hard to speed up with specialized hardware, all to prevent brute forcing. There is ab interesting parallel with PoW systems. Many cryptos have switched PoW algorithm to remove the advantage of specialized hardware. This is supposed to prevent decentralization.
    - once_inc 5y ago
      > There is an interesting parallel with PoW systems. Many cryptos have switched PoW algorithm to remove the advantage of specialized hardware. This is supposed to prevent decentralization. Unfortunately, this tends to just prolong the development of ASIC's, and often keeps the first working versions hidden from the public with the sole purpose of being able to mine with vastly increased efficiency compared to others.
      - rocqua 5y ago
        I think it worked for EthHash, given the number of GPUs using it. Monero's RandomX also seems succesful, but that has a higher bar (wanting to be CPU only) and a smaller footprint so ASICs might be easier to hide. As a bonus for KDFs, there is much less economic pressure to 'break' them. So trying to develop ASICs / FPGAs / GPU implementation is pure cost, rather than an investment.
    - hollerith 5y ago
      I think you mean, "prevent centralization".
    - CyberDildonics 5y ago
      Making a hash algorithm suited to general purpose hardware helps decentralization.

tptacek 5y ago

SHA-XXX is also not an acceptable password hash.

CamperBob2 5y ago
Why not?
- throwaway787544 5y ago
  Because a password hash should be based on a KDF and SHA hash algorithms aren't. https://en.m.wikipedia.org/wiki/Key_derivation_function https://en.m.wikipedia.org/wiki/Key_derivation_function
- rocqua 5y ago
  Because it is fast. Password hashing is better a slow function to compute. Delaying login by e.g. 0.001s (say 1000 times slower than normal) is unnoticeable, and login is rare enough that the total compute impact is quite low. But for a brute force attack a 1000 times slowdown is horrible. Even if specialized hardware makes it only 10 times slower it might still be effective. KDFs try to be slow, and they try to be hard to speed up with specialized hardware, all to prevent brute forcing. There is ab interesting parallel with PoW systems. Many cryptos have switched PoW algorithm to remove the advantage of specialized hardware. This is supposed to prevent decentralization.
  - once_inc 5y ago
    > There is an interesting parallel with PoW systems. Many cryptos have switched PoW algorithm to remove the advantage of specialized hardware. This is supposed to prevent decentralization. Unfortunately, this tends to just prolong the development of ASIC's, and often keeps the first working versions hidden from the public with the sole purpose of being able to mine with vastly increased efficiency compared to others.
    - rocqua 5y ago
      I think it worked for EthHash, given the number of GPUs using it. Monero's RandomX also seems succesful, but that has a higher bar (wanting to be CPU only) and a smaller footprint so ASICs might be easier to hide. As a bonus for KDFs, there is much less economic pressure to 'break' them. So trying to develop ASICs / FPGAs / GPU implementation is pure cost, rather than an investment.
  - hollerith 5y ago
    I think you mean, "prevent centralization".
  - CyberDildonics 5y ago
    Making a hash algorithm suited to general purpose hardware helps decentralization.