3 ms·

I'm curious if someone could comment on something. If a bunch of strings, let's say email address, are concatenated with a single, secret 128bit string, and the

I'm curious if someone could comment on something. If a bunch of strings, let's say email address, are concatenated with a single, secret 128bit string, and then the resulting concatenation is hashed. Let's say sha256. Is something like this safe against the kind of rigs and attacks being built in 2024? You can assume the hashes are publicly downloadable, but the secret remains secret. EDIT: Thanks for the replies. The use case is that I made a commenting system that accepts submissions via email. However, it's only being used by my personal website right now, because I'm gathering feedback on it. You can see it at https://r3ply.com https://r3ply.com. Two things to protect are privacy of commentators, and to prevent tampering of the subject line. I had plans to use an HMAC, but right now I just naively sha256(message+pepper).

gcr 3y ago
The standard answer is “use bcrypt and don’t try to roll your own” Example when you say concatenation, do you mean hash(email + secret) or hash(secret + email)? The choice matters: off the top of my head, I know the former lets an attacker reuse state between hashing attempts if the emails are known because hashing occurs one block at a time, so knowing. I wouldn’t be surprised if the later had weaknesses too. Keep in mind most emails appear in public databases, so it’s not clear what you’re trying to protect.
- iraqmtpizza 3y ago
  true. SHA-256 is vulnerable to length extension attacks because it uses Merkle–Damgård. one reason to consider SHA-3 which is a sponge. except not for password hashing because that requires a resource-intensive function like Argon2
mratsim 3y ago
Not sure what's your use-case and threat model, but HKDF is likely what you want, the concatenation is done in a way to prevent attacks: https://www.rfc-editor.org/rfc/rfc5869 https://www.rfc-editor.org/rfc/rfc5869
px43 3y ago
> the secret remains secret An attacker in a position to grab password hashes is also going to be in a position to grab that secret. No matter how you shuffle and try to hide it, there's not really a way around that.
- asimpletune 3y ago
  I meant, for the purpose of my threat model, I am not concerned with defending against attacks on the secret and we can just assume the storage of it is safe or out of scope, whichever interpretation you prefer.
Thorrez 3y ago
I think your system is probably secure. But your system is relying on sha256 providing a guarantee that it wasn't designed to provide. It's better to only rely on dependencies in ways they actually were designed for.

gcr 3y ago

The standard answer is “use bcrypt and don’t try to roll your own” Example when you say concatenation, do you mean hash(email + secret) or hash(secret + email)? The choice matters: off the top of my head, I know the former lets an attacker reuse state between hashing attempts if the emails are known because hashing occurs one block at a time, so knowing. I wouldn’t be surprised if the later had weaknesses too. Keep in mind most emails appear in public databases, so it’s not clear what you’re trying to protect.

iraqmtpizza 3y ago
true. SHA-256 is vulnerable to length extension attacks because it uses Merkle–Damgård. one reason to consider SHA-3 which is a sponge. except not for password hashing because that requires a resource-intensive function like Argon2

mratsim 3y ago

Not sure what's your use-case and threat model, but HKDF is likely what you want, the concatenation is done in a way to prevent attacks: https://www.rfc-editor.org/rfc/rfc5869 https://www.rfc-editor.org/rfc/rfc5869

px43 3y ago

> the secret remains secret An attacker in a position to grab password hashes is also going to be in a position to grab that secret. No matter how you shuffle and try to hide it, there's not really a way around that.

asimpletune 3y ago
I meant, for the purpose of my threat model, I am not concerned with defending against attacks on the secret and we can just assume the storage of it is safe or out of scope, whichever interpretation you prefer.

Thorrez 3y ago

I think your system is probably secure. But your system is relying on sha256 providing a guarantee that it wasn't designed to provide. It's better to only rely on dependencies in ways they actually were designed for.