9 ms·
Password Hashing Competition
- Zenst 14y agoNo panic, just if you use IE read this: http://en.wikipedia.org/wiki/Server_Name_Indication#Support http://en.wikipedia.org/wiki/Server_Name_Indication#Support Real browsers like Opera, Chrome, firefox.... all good my bad and edited my panic away. Thanks dchest for being more awake than I.
- dchest 14y agoWhat problem? What browser and OS do you use?
- Zenst 14y agoOn my other computer - and sadly had IE (latest and patched IE 9) running. Now checked with Opera, firefox and Chrome and they get issued a different certificate - most odd and probably a anti IE thing. IE seems to get a certificate for www.131002.net, others get certificate for that site. Different expiry dates and details so again probably a anti IE script of some form.
- dchest 14y agoAha, it's because IE on WinXP doesn't support SNI (http://en.wikipedia.org/wiki/Server_Name_Indication#Support http://en.wikipedia.org/wiki/Server_Name_Indication#Support). Unfortunately, there's no way for servers to work around this other than putting different domains on different IP addresses.
- Zenst 14y agoBox in question has Vista, and did have TLS disabled. Still I'll blame microsoft.
- dchest 14y agoI only found this about Windows 7 / IE8 SNI problem, maybe it'll help http://answers.microsoft.com/en-us/ie/forum/ie8-windows_7/sni-support-not-working-in-ie-8-windows-7/de189384-cefb-4234-ab95-36a7a5e3d5bc http://answers.microsoft.com/en-us/ie/forum/ie8-windows_7/sn...
- Zenst 14y agoI edited the original post to highlight my stupidity and many thanks for being more awake than I. I'll have a read thru that when a bit more awake but moral being. Don't use IE, even if you are using one of your lesser computers :|. Again thank you.
- marshray 14y agoDid you make customizations to end up with TLS disabled in IE on Vista? Or did you end up this way fom default settings?
- Zenst 14y agoBy default TLS 1.0 is enabled, I disabled it myself ages ago as other more robust options were supported and whilst extensions have been added at the time I felt it was for the best. Worked fine for me until this moment at least when I have used that particular box, but nice to always learn. in short - no default is TLS 1.0 on, I changed it to disabled for TLS 1.0 and left SSL 2.0 and 3.0 enabled as they are by default.
- marshray 14y agoSSL 2.0 is old and busted. You ought to disable it. SSL 3.0 is all-but identical to TLS 1.0.
- CodesInChaos 14y agoWhy do you disable the newest protocol version (TLS 1.0 is essentially SSL 3.1) but keep the older versions? I'd enable SSL 3.0 and TLS 1.x, but disable SSL 2.0 since it's old and broken.
- stephengillie 14y agoThe certificate looks good to my browser. shrug It's a StartCom intermediate certificate, good from 2/5/13 to 2/7/14, and the connection is encrypted with RC4_128. So says Chrome...
- Zenst 14y agoYes yoru spot on, just looked into it more and it is TLS 1.0 on chrome and I disabled that upon my IE browser, so may be the issue and explains why. Though as different certificate my initial thoughts are still with some anti IE script of some form - IE gets cert for differnt site and also from same issuing authority. No panic.
- bradleyjg 14y agoGiven that bcrypt and scrypt have had very little attention from cryptographers, it would be a better to start there than adding even more schemes. Unless there is some reason to believe that the winner of this contest will attract serious analysis. If that's true then they should probably allow the established players to enter. Diversity isn't necessarily a good thing in security. Look at all the attacks on SSL/TLS that rely on being able to negotiate a cypher.
- dchest 14y agoI think that's exactly one of the purposes of competition: to attract more attention and analysis. I'm pretty sure we'll see some variant of scrypt there ;)
- trebor 14y agoCan you cite anything that shows that bcrypt hasn't been studied by cryptographers? I've not heard that yet and would like to add it to my research (I keep notes on good password storage techniques).
- dfc 14y agoI am not sure how you are supposed to prove a negative. However I have often wondered why scrypt/bcrypt do not show up in any literature reviews. Search for scrypt/bcrypt: https://eprint.iacr.org/search.html https://eprint.iacr.org/search.html
- trebor 14y agoI didn't have that link, and that pretty well backs your point. I know proving a negative is next to impossible, but I figured that you'd have a reason for making the assertion 9which I wanted to know). The closest I can find to a study of bcrypt/scrypt is: http://www.openwall.com/presentations/YaC2012-Password-Hashing-At-Scale/ http://www.openwall.com/presentations/YaC2012-Password-Hashi... http://www.openwall.com/presentations/ZeroNights2012-New-In-Password-Hashing/ http://www.openwall.com/presentations/ZeroNights2012-New-In-... Technically these are reviews/improvements to scrypt rather than an in-depth analysis of the security of the algorithm. Even the Security StackExchange site is kind of silent on the issue: http://security.stackexchange.com/questions/4781/do-any-security-experts-recommend-bcrypt-for-password-storage http://security.stackexchange.com/questions/4781/do-any-secu...
- jstalin 14y agoWhile I think it's cool to have a competition to help come up with better, "standardized" methods of hashing, PBKDF2 is pretty good already. The problem seems to be a lack of implementation, not a lack of good options.
- dchest 14y agoPBKDF2 is not pretty good: the difference between GPU/hardware-accelerated implementations of PBKDF2 with common hashes and software implementations for CPUs is huge. Plus you can compute it in parallel cheaply. See scrypt paper for details: http://www.tarsnap.com/scrypt.html http://www.tarsnap.com/scrypt.html
- jstalin 14y agoI can't find in that paper how many iterations they put PBKDF2 through and which hashing algorithm they used. Any implementation of PBKDF2 I do uses a very high number of iterations (50,000+) and I use whirlpool, which is amongst the slowest of algorithms.
- dchest 14y ago100ms in table: PBKDF2-HMAC-SHA256 with an iteration count of 86,000; 5s: PBKDF2-HMAC-SHA256 with an iteration count of 4,300,000 (see page 13). If you're using the slowest possible algorithm/biggest number of iterations, you're still vulnerable to parallel attacks: imagine a huge number of cheap chips bruteforcing passwords. Scrypt tries to maximize the cost of such chips by requiring large amounts of RAM for computation. Again, this is explained in the paper.
- jstalin 14y agoThanks.
- Zenst 14y ago"• The poor state of passwords protection in web services: passwords are too often either stored in clear (these are the services that send you your password by email after hitting "I forgot my password"), or just hashed with a cryptographic hash function (like MD5 or SHA-1), which exposes users' passwords to efficient brute force cracking methods." That is a huge issue that I wished was made a criminal action. But when a user forgets there password, the issue of issuing a new one falls down to verifying the user is who they say they are without a password and falls down to the previous details held by that user. Be it phone number to SMS a reset code or email to issue a rest code or new password. It is a hard area that will always have a weakness. I do wonder if the postal system could step in by offering a service which you could walk in - show your passport or supporting ID and have them issue you with a rest code which you could use upon the site. Certianly would add to the services they offered and whilst it would not be instant or as easy for many it certainly would be far more robust way to address the issue. A service that until something better comes along that would work for everybodies best interests. Maybe a good opertunity for a startup to pursue.
- cheald 14y agoHashing data with SHA1 should be a criminal offense? Seriously?
- Zenst 14y agopartialy in jest but what I mean we often come across sitess that have issues and boils down to unsalted weak security hashing. In that you only find out about such weakness's when things go wrong. Certainly MD5 I'd say less in jest but as for SHA1 and any hashing that is found to have flaws and known about for a while the ongoing use is really down to its working don't touch it. Now if you have a site using say MD5 or SHA1 hashing unsalted and they get attacked and leaked then the attacked can brute force those hash's into plain text. If a site works and uses poor security and is not attacked then what forced them to maintain there security or improve it as it is seemed just to work. Sadly hindsite and reaction to security issues or break ins with password hash tables stolen for many sites is when they do something and that is retrospectively. So in a way a law that forced or even focused site owners to deal with problems before they are problems would only be good for joe publics privacy. Maybe a law or other means are the way, maybe not. But certainly the current situaton and attitude by some managment in companies towards there IT people with regards to them wanting to fix issues that are not obviously an issue now can only but help. I know and I'm sure others have known of situations in IT when the IT people want to do something to fix a potentual problem and yet budgets prevent them as it is not an issue and certainly from my experience of companies that use ITIL or other approaches they bias towards retrospective approach's in contrast to proactive ones. So if it takes a law to focus and support the IT people in companies to enable them to do the right thing then it can only be good.
- josephscott 14y ago"The poor state of passwords protection in web services: passwords are too often either stored in clear (these are the services that send you your password by email after hitting "I forgot my password"), or just hashed with a cryptographic hash function (like MD5 or SHA-1), which exposes users' passwords to efficient brute force cracking methods." If you can't get people to use current crypto hashing techniques like bcrypt or scrypt why would coming up with another one help? Of course it would be nice to see something with the work factor features of bcrypt that were more specifically resistant to GPU optimized crackers.
- tptacek 14y agoI'm torn.† On the one hand, it sends a "jury is out" message on modern password hashing in general. On the other hand, developers already handwave about "bcrypt not having gotten enough cryptographic review", as if someone was ever going to publish a cryptanalytic result showing bcrypt to be worse than SHA1. I'd have liked the jury to have been back on this last decade, but I'll settle for it being in next year. By the way, the construction you're looking for is scrypt. † I'm not really torn.
- marshray 14y ago> "jury is out" One advantage of a jury being out is that someday said jury can come back in and return a verdict. > as if someone was ever going to publish a cryptanalytic result showing bcrypt to be worse than SHA1. SHA-1 has a formal specification, an RFC, a reference implementation, implementation guidance, and comprehensive test vectors published. To date, bcrypt is lacking some of those things. And yes, bcrypt has gotten pwned worse than SHA-1 as a result: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2483 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2483
- tptacek 14y agoGive me a break. That's an application implementation flaw, and one no standard could have prevented. It's like saying that insufficient cryptanalysis is responsible for the OpenSSL RCEs. Again: I'm not really torn. It's a good thing you're all doing this. The jury is not really out on bcrypt, though.