5 ms·

Both are correct. A cryptographic hash function is a hash function that is not invertible, resists tampering and collisions, and has other properties. Using cry

Both are correct. A cryptographic hash function is a hash function that is not invertible, resists tampering and collisions, and has other properties. Using cryptographic hash functions in certain cryptographic settings is appropriate. SHA256("My Super Secret Password") is not one of those settings. SHA256 can be the basis of a scheme to securely store passwords. There are many different names for that: * key derivation function * secure password storage scheme * password scrambler (PHK's term) * (...) A secure password storage scheme uses a cryptographic primitive like a cryptographic hash or a cipher to increase the time it takes to decrypt passwords. That's a good thing, because when it takes your user 0.5 seconds to go from "right password -> on disk hash", it'll take a prohibitively long time for an attacker to guess through passwords.

aerovistae 12y ago
Okay, that makes sense. SHA-256 for 50 iterations, with salting: is that equivalent to bcrypt in the matter of slowing things down....is it good enough?
- owenmarshall 12y ago
  > SHA-256 for 50 iterations (...) is it good enough? If you mean they call SHA256(SHA256(...48 more calls("password" + salt))? That's not remotely good enough. http://hashcat.net/oclhashcat/ http://hashcat.net/oclhashcat/ -- look at the hardware and see for yourself; those values for SHA256 are million hashes per second. So 50 rounds of SHA256 can be computed in less than a microsecond. https://twitter.com/hashcat/status/349192539443699713 https://twitter.com/hashcat/status/349192539443699713 -- now, Bcrypt. I'm not sure what their bcrypt difficulty is, but whatever it is: bcrypt makes it five or six orders of magnitude harder. And remember, bcrypt (like good KDFs) is tunable, so you could make that as hard as you want. EDIT: Some further consideration: http://arstechnica.com/security/2012/12/25-gpu-cluster-cracks-every-standard-windows-password-in-6-hours/ http://arstechnica.com/security/2012/12/25-gpu-cluster-crack... > As a result, the new cluster, even with its four-fold increase in speed, can make only 71,000 guesses against Bcrypt and 364,000 guesses against SHA512crypt. https://github.com/freedomofpress/securedrop/issues/180 https://github.com/freedomofpress/securedrop/issues/180 has some more numbers as well.
  - aerovistae 12y ago
    Not quite-- 50 iterations of `hash = SHA256(hash + salt)` Any better? (EDIT: Still in process of reading links.)
    - owenmarshall 12y ago
      >(EDIT: Still in process of reading links.) Sorry, I'll try to stop incessantly editing ;-) > Any better? No. General purpose cryptographic hash functions are designed to be incredibly fast. http://www.intel.com/content/dam/www/public/us/en/documents/white-papers/haswell-cryptographic-performance-paper.pdf http://www.intel.com/content/dam/www/public/us/en/documents/... But convince yourself. Do you have Ruby? http://pastebin.com/zjLiYt2j http://pastebin.com/zjLiYt2j If I bump up your password scheme by 4 orders of magnitude it's still under <.06 seconds on my machine. And that's with a ridiculously inefficient password generator I banged up in ten seconds. Use bcrypt. Use scrypt. Use PBKDF2. Don't roll your own password stretching function, it's a recipe for disaster.
      - aerovistae 12y ago
        Thanks very much, all very clear now. I'll try to persuade the people who have a say in the matter...it's tricky when you're not really an expert yourself so you can't fully explain the matter to a perfect extent, and you're stuck saying "but people on the internet said..."
        sarciszewski 12y ago
        If you mention Thomas Ptacek of Matasano Security (that's who tptacek is), they might be more inclined to listen. Sadly, my name is of little value and if they had heard of it, they'd probably assume malicious intent.
        owenmarshall 12y ago
        Half the problem is that quite a few standards/compliance groups don't impose the right requirements. PCI audits used to just check for "encrypted passwords." OWASP does make a decent recommendation, maybe that'll help give you a leg to stand on: https://www.owasp.org/index.php/Password_Storage_Cheat_Sheet#Impose_infeasible_verification_on_attacker https://www.owasp.org/index.php/Password_Storage_Cheat_Sheet...

aerovistae 12y ago

Okay, that makes sense. SHA-256 for 50 iterations, with salting: is that equivalent to bcrypt in the matter of slowing things down....is it good enough?

owenmarshall 12y ago
> SHA-256 for 50 iterations (...) is it good enough? If you mean they call SHA256(SHA256(...48 more calls("password" + salt))? That's not remotely good enough. http://hashcat.net/oclhashcat/ http://hashcat.net/oclhashcat/ -- look at the hardware and see for yourself; those values for SHA256 are million hashes per second. So 50 rounds of SHA256 can be computed in less than a microsecond. https://twitter.com/hashcat/status/349192539443699713 https://twitter.com/hashcat/status/349192539443699713 -- now, Bcrypt. I'm not sure what their bcrypt difficulty is, but whatever it is: bcrypt makes it five or six orders of magnitude harder. And remember, bcrypt (like good KDFs) is tunable, so you could make that as hard as you want. EDIT: Some further consideration: http://arstechnica.com/security/2012/12/25-gpu-cluster-cracks-every-standard-windows-password-in-6-hours/ http://arstechnica.com/security/2012/12/25-gpu-cluster-crack... > As a result, the new cluster, even with its four-fold increase in speed, can make only 71,000 guesses against Bcrypt and 364,000 guesses against SHA512crypt. https://github.com/freedomofpress/securedrop/issues/180 https://github.com/freedomofpress/securedrop/issues/180 has some more numbers as well.
- aerovistae 12y ago
  Not quite-- 50 iterations of `hash = SHA256(hash + salt)` Any better? (EDIT: Still in process of reading links.)
  - owenmarshall 12y ago
    >(EDIT: Still in process of reading links.) Sorry, I'll try to stop incessantly editing ;-) > Any better? No. General purpose cryptographic hash functions are designed to be incredibly fast. http://www.intel.com/content/dam/www/public/us/en/documents/white-papers/haswell-cryptographic-performance-paper.pdf http://www.intel.com/content/dam/www/public/us/en/documents/... But convince yourself. Do you have Ruby? http://pastebin.com/zjLiYt2j http://pastebin.com/zjLiYt2j If I bump up your password scheme by 4 orders of magnitude it's still under <.06 seconds on my machine. And that's with a ridiculously inefficient password generator I banged up in ten seconds. Use bcrypt. Use scrypt. Use PBKDF2. Don't roll your own password stretching function, it's a recipe for disaster.
    - aerovistae 12y ago
      Thanks very much, all very clear now. I'll try to persuade the people who have a say in the matter...it's tricky when you're not really an expert yourself so you can't fully explain the matter to a perfect extent, and you're stuck saying "but people on the internet said..."
      - sarciszewski 12y ago
        If you mention Thomas Ptacek of Matasano Security (that's who tptacek is), they might be more inclined to listen. Sadly, my name is of little value and if they had heard of it, they'd probably assume malicious intent.
      - owenmarshall 12y ago
        Half the problem is that quite a few standards/compliance groups don't impose the right requirements. PCI audits used to just check for "encrypted passwords." OWASP does make a decent recommendation, maybe that'll help give you a leg to stand on: https://www.owasp.org/index.php/Password_Storage_Cheat_Sheet#Impose_infeasible_verification_on_attacker https://www.owasp.org/index.php/Password_Storage_Cheat_Sheet...