4 ms·

The reason you are being downvoted is because you apparently dont agree with the entire purpose of password hashes. The reason you cant use a hash like the sha

The reason you are being downvoted is because you apparently dont agree with the entire purpose of password hashes. The reason you cant use a hash like the sha family is because they are too fast and prone to dictionary attacks. The solution is to slow them down. That is one of the primary functions of a password hash: to provide the ability to slow down the hash computation. This is usually done with a "work factor" which translates roughly to how many times you iterate with the hashing function. This repetition allows you to make the password hash to take arbitrarily long. With a work factor of 14 (2 ^ 14 rounds), bcrypt takes about a second to compute a hash on my machine. There are approximately 100k words in the english language and add one number and you are already at 1 million seconds to reverse a single hash. Compare this to the sha family where you take fractions of a second to hash a password.

itistoday2 12y ago
> The reason you are being downvoted is because you apparently dont agree with the entire purpose of password hashes. The reason you cant use a hash like the sha family is because they are too fast and prone to dictionary attacks. The solution is to slow them down. You misunderstand me. Please have a look at my reply to pbsd, I think it addresses your comments there too: https://news.ycombinator.com/item?id=8087975 https://news.ycombinator.com/item?id=8087975 I did say there: "I stand corrected about KDFs not being OK for password storage".
- tptacek 12y ago
  I've read all your comments on this thread. I'm still unclear on why you think the problem of stretching a low-entropy secret into the high-entropy secret needed for strong cryptography is somehow different from the problem of safely storing a password so that disclosure of the authenticator doesn't directly compromise the password. At this point, given the content on this thread, it seems that it's been explained clearly enough why salted SHAx is inadequate to that task. Do you still not understand why that is? Until Windows finally got plugged into the Internet and the weak LANMAN hash became relevant to hackers, nobody used "rainbow tables" to break passwords (classic Unix crypt passwords aren't particularly vulnerable to them, since they're salted). But --- and this is crucial --- everyone cracked Unix password files. All of the original password cracking tools, from Crack through JtR, were designed to quickly crack salted hashes.
  - itistoday2 12y ago
    > At this point, given the content on this thread, it seems that it's been explained clearly enough why salted SHAx is inadequate to that task. Do you still not understand why that is? Don't worry, I understand very well (this is not rocket science :P). My problem, I think, was an inappropriate attitude toward the realities of stored password hashes on servers, in addition to having read that "scrypt is bad for password storage" (and having misunderstood the "badness" of it). I had read too many articles that treated HASH + SALT as "OK" for servers that stored user passwords, and I hadn't kept fresh in my mind the speed with which these passwords can be cracked today. For example, take the article I linked to in my reply to pbsd: https://crackstation.net/hashing-security.htm https://crackstation.net/hashing-security.htm (recently written). This article, and many many others like it, are written by seemingly reputable people, and yet their attitude is that HASH + SALT is OK for servers. Even though it discusses bcrypt, etc., it frames it as though it's an "optional" hardening technique, and places HASH + SALT under the category of "proper hashing": https://crackstation.net/hashing-security.htm#properhashing https://crackstation.net/hashing-security.htm#properhashing I haven't seen them called out on it. I agree with you and the others in this thread, that it isn't good advice. If 10-char passwords can be protected better with KDFs, then they should be.
    - tptacek 12y ago
      Every article you've read that suggests salted hashes are adequate stored password authenticators is wrong. I don't know what the "security community" is, but if it has any relation to "the community of people who can speak with any authority on cryptography", let me ruefully assure you that it is much, much smaller than you think it is.
      - itistoday2 12y ago
        > Every article you've read that suggests salted hashes are adequate stored password authenticators is wrong. Thanks for making that very clear. :) Re "security community", sorry, I'd edited that part out before I saw your reply, and replaced it with a call for these posts to be called out for giving bad advice.

itistoday2 12y ago

> The reason you are being downvoted is because you apparently dont agree with the entire purpose of password hashes. The reason you cant use a hash like the sha family is because they are too fast and prone to dictionary attacks. The solution is to slow them down. You misunderstand me. Please have a look at my reply to pbsd, I think it addresses your comments there too: https://news.ycombinator.com/item?id=8087975 https://news.ycombinator.com/item?id=8087975 I did say there: "I stand corrected about KDFs not being OK for password storage".

tptacek 12y ago
I've read all your comments on this thread. I'm still unclear on why you think the problem of stretching a low-entropy secret into the high-entropy secret needed for strong cryptography is somehow different from the problem of safely storing a password so that disclosure of the authenticator doesn't directly compromise the password. At this point, given the content on this thread, it seems that it's been explained clearly enough why salted SHAx is inadequate to that task. Do you still not understand why that is? Until Windows finally got plugged into the Internet and the weak LANMAN hash became relevant to hackers, nobody used "rainbow tables" to break passwords (classic Unix crypt passwords aren't particularly vulnerable to them, since they're salted). But --- and this is crucial --- everyone cracked Unix password files. All of the original password cracking tools, from Crack through JtR, were designed to quickly crack salted hashes.
- itistoday2 12y ago
  > At this point, given the content on this thread, it seems that it's been explained clearly enough why salted SHAx is inadequate to that task. Do you still not understand why that is? Don't worry, I understand very well (this is not rocket science :P). My problem, I think, was an inappropriate attitude toward the realities of stored password hashes on servers, in addition to having read that "scrypt is bad for password storage" (and having misunderstood the "badness" of it). I had read too many articles that treated HASH + SALT as "OK" for servers that stored user passwords, and I hadn't kept fresh in my mind the speed with which these passwords can be cracked today. For example, take the article I linked to in my reply to pbsd: https://crackstation.net/hashing-security.htm https://crackstation.net/hashing-security.htm (recently written). This article, and many many others like it, are written by seemingly reputable people, and yet their attitude is that HASH + SALT is OK for servers. Even though it discusses bcrypt, etc., it frames it as though it's an "optional" hardening technique, and places HASH + SALT under the category of "proper hashing": https://crackstation.net/hashing-security.htm#properhashing https://crackstation.net/hashing-security.htm#properhashing I haven't seen them called out on it. I agree with you and the others in this thread, that it isn't good advice. If 10-char passwords can be protected better with KDFs, then they should be.
  - tptacek 12y ago
    Every article you've read that suggests salted hashes are adequate stored password authenticators is wrong. I don't know what the "security community" is, but if it has any relation to "the community of people who can speak with any authority on cryptography", let me ruefully assure you that it is much, much smaller than you think it is.
    - itistoday2 12y ago
      > Every article you've read that suggests salted hashes are adequate stored password authenticators is wrong. Thanks for making that very clear. :) Re "security community", sorry, I'd edited that part out before I saw your reply, and replaced it with a call for these posts to be called out for giving bad advice.