6 ms·
> SHA-256 for 50 iterations (...) is it good enough? If you mean they call SHA256(SHA256(...48 more calls("password" + salt))? That's not remotely good enough
by owenmarshall 12y ago
> SHA-256 for 50 iterations (...) is it good enough?
If you mean they call SHA256(SHA256(...48 more calls("password" + salt))?
That's not remotely good enough.
http://hashcat.net/oclhashcat/ http://hashcat.net/oclhashcat/ -- look at the hardware and see for yourself; those values for SHA256 are million hashes per second.
So 50 rounds of SHA256 can be computed in less than a microsecond.
https://twitter.com/hashcat/status/349192539443699713 https://twitter.com/hashcat/status/349192539443699713 -- now, Bcrypt.
I'm not sure what their bcrypt difficulty is, but whatever it is: bcrypt makes it five or six orders of magnitude harder. And remember, bcrypt (like good KDFs) is tunable, so you could make that as hard as you want.
EDIT: Some further consideration: http://arstechnica.com/security/2012/12/25-gpu-cluster-cracks-every-standard-windows-password-in-6-hours/ http://arstechnica.com/security/2012/12/25-gpu-cluster-crack...
> As a result, the new cluster, even with its four-fold increase in speed, can make only 71,000 guesses against Bcrypt and 364,000 guesses against SHA512crypt.
https://github.com/freedomofpress/securedrop/issues/180 https://github.com/freedomofpress/securedrop/issues/180 has some more numbers as well.
- aerovistae 12y agoNot quite-- 50 iterations of `hash = SHA256(hash + salt)` Any better? (EDIT: Still in process of reading links.)
- owenmarshall 12y ago>(EDIT: Still in process of reading links.) Sorry, I'll try to stop incessantly editing ;-) > Any better? No. General purpose cryptographic hash functions are designed to be incredibly fast. http://www.intel.com/content/dam/www/public/us/en/documents/white-papers/haswell-cryptographic-performance-paper.pdf http://www.intel.com/content/dam/www/public/us/en/documents/... But convince yourself. Do you have Ruby? http://pastebin.com/zjLiYt2j http://pastebin.com/zjLiYt2j If I bump up your password scheme by 4 orders of magnitude it's still under <.06 seconds on my machine. And that's with a ridiculously inefficient password generator I banged up in ten seconds. Use bcrypt. Use scrypt. Use PBKDF2. Don't roll your own password stretching function, it's a recipe for disaster.
- aerovistae 12y agoThanks very much, all very clear now. I'll try to persuade the people who have a say in the matter...it's tricky when you're not really an expert yourself so you can't fully explain the matter to a perfect extent, and you're stuck saying "but people on the internet said..."
- sarciszewski 12y agoIf you mention Thomas Ptacek of Matasano Security (that's who tptacek is), they might be more inclined to listen. Sadly, my name is of little value and if they had heard of it, they'd probably assume malicious intent.
- owenmarshall 12y agoHalf the problem is that quite a few standards/compliance groups don't impose the right requirements. PCI audits used to just check for "encrypted passwords." OWASP does make a decent recommendation, maybe that'll help give you a leg to stand on: https://www.owasp.org/index.php/Password_Storage_Cheat_Sheet#Impose_infeasible_verification_on_attacker https://www.owasp.org/index.php/Password_Storage_Cheat_Sheet...
- Alupis 12y ago> PCI audits used to just check for "encrypted passwords. PCI is a joke. The self-fill audit: "Are you secure?" -- Uh... sure? The various scanning companies are of differing quality too, adding to the difficulty in getting any real security improvements from the standard across all ecommerce shops.
- sarciszewski 12y agoAFAIK, PCI is an unfunny joke. This is why my pentester friends have told me about it: > Release v1.0 of super cool app. > v1.0 gets PCI certified > Someone discloses a vuln in v1.0 > Release v1.1 > Companies are stuck with v1.0 for at least 90 days until v1.1 can be certified
- wglb 12y agobcrypt makes it five or six orders of magnitude harder. And its work factor is adjustable at run-time for the time that hardware speed increases.