I just read an article. And it's said:
So I’m not saying salts are without purpose, I’m saying that they
don’t prevent dictionary or brute force attacks (which they don’t).
If you have a database dump, with hashed passwords and salts, you can start brute force only if you know crypt algorithm. If you use open source, it can be a problem. But if you change algorithm a little, it's not a problem, until somebody know it. Am I right?
Troy Hunt recently wrote an excellent article, Our password hashing has no clothes, detailing the evolution of password hashing, including Salts.
Although Salts prevented direct comparisons with pre-hashed rainbow tables, his point is that hardware has improved to the point where applying the salt to an unhashed rainbow password and comparing salted hashes can now be done in a short time due to Moore's law.
As Trickfire states, using a proprietary hashing algorithm is security through obscurity. If the attacker has your database, he will also likely be able to get your app and disassemble it and obtain the algorithm.
Security through obscurity
While it makes the problem of figuring out the password a little harder, relying on this technique is not suggested.
Related
I am trying to decide the best hashing algorithm for my password encryption.
When I go to PBKDF2 page, I can clearly see that it accepts salt and number of iterations, and indeed I can provide both of them in my node.js script. Similar situation is with Bcrypt, it has salt and number of iterations.
But when I go to SHA wiki then I can't find even a mention of salting or giving number of iterations. SHA doesn't have salting then? But from time to time I stumble upon links on the Internet that do talk about SHA salting.
Sorry if the question is stupid, but I am genuinely confused with all this crypto algorithms.
p.s. I use node.js to play around with those algorithms
I had not touch crypto algorithms in a while but i'm sure you can use hashes in Secure Hash Algorithm from the family of hash functions SHA-2 and also in SHA-3, being called Salted Secure Hash Algorithm or SSHA.
Depending on how secure you want it to be, SSHA-256 is far more secure than SHA-256 but Secure Hash Algorithm are not recommended for your purpose, due of they intend to be fast and they lack on password encryption being vulnerable to brute force and dict attacks.
For it, you need something designed to be difficult to serialize and/or optimize, that requires loads of workload.
Argon2, BCrypt or PBKDF2 are the safest options in terms of password encryption.
In case you want some theorical approach and further understanding of the topic, you can check the following post: https://auth0.com/blog/adding-salt-to-hashing-a-better-way-to-store-passwords/
Have a nice day!
The site I'm working on right now uses a third-party billing company that handles user sign-ups, so all user names and passwords are entered in the biller's site, then the biller writes the username and the user's now encrypted password to a 'members' database on our server.
The problem is that the biller (and many of them, from what I gather) encrypts the passwords with MD5 which I have read over and over is NOT secure. But, as the encryption is handled at the biller's end, and they are only offering MD5, I wanted to know if there was anything I could do on my end to make the passwords more secure?
As I'm writing this, I'm thinking that, 'If the biller is encrypting the passwords, there's probably no way for me to add more security' because part of the biller's job is to handle member issues such as lost passwords and other issues.
So...is there a way to add more security to the passwords the biller stores in our DB or do we just take our chances with what we all know is an unsafe standard? We're stuck with this biller for the short term, and what's worse, I contacted another biller who is very well known and they use MD5 as well.
Many thanks in advance!
Unfortunately, there's not a lot you can do about the biller at this stage. It's difficult to know what threats you're trying to mitigate against. If you're worried about the communication between the biller and your machines being monitored then SSL or SSH should help with that. If you're worried about an attacker breaking into your database and stealing passwords, then using a different scheme to store the passwords in will help.
You can either stick with MD5 and add a salt. Please check that your biller is salting their passwords, if they're not you really need to get rid of them. They're database will be vulnerable to rainbow table lookups.
A rainbow table is a precomputed table for reversing cryptographic hash functions, usually for cracking password hashes
You could take the MD5s you receive and use a better password hashing algorithm (assuming you don't need to keep the original MD5). One example is bcrypt. Note that SHA1, SHA-256, etc. whilst better hashing algorithms are not that great at password hashing. The reason is that SHA is designed to be fast. You want password hashing to be relatively slow. For legitimate users, waiting 20ms for a correct password validation is no time at all, but for an attacker it drastically reduces their ability to brute force a password.
bcrypt is a key derivation function for passwords designed by Niels Provos and David Mazières, based on the Blowfish cipher, and presented at USENIX in 1999.[1] Besides incorporating a salt to protect against rainbow table attacks, bcrypt is an adaptive function: over time, the iteration count can be increased to make it slower, so it remains resistant to brute-force search attacks even with increasing computation power.
Essentially, bcrypt has a good hashing algorithm, requires a salt and lets you specify the number of times the hashing algorithm is run on it. You could, for example, start off with 100 rounds. In two years time when computing power has increased you can then increase that to 150.
Md5 is technically a hasing algorithm, not an encryption algorithm. The difference being that you cannot unhash a a hashed string (in theory, md5 is weak because this was proven false). You can undo encrypting if you have the appropriate key.
What is your biggest concern? Are you worried about someone intercepting the passwords as they travel between you and the biller or are you worried about someone opening the database?
If you are worried about someone breaking into your database and getting your table with passwords, then you can definitely improve the security. You could encrypt the entries before you persist them using a modern algorithm with your own private key. Don't store the key with the server and unencrypt when pulling out of the database before using the md5 value.
You could also, just hash the md5 value they give you (and use a salt) with some modern strong hashing algorithm. This means that if anyone gets your table, they will have to unhash your hash, then unhash the md5. Presumably you would use a strong hash and the first step would be impossible. As always, be careful with security as you most certainly should write something yourself, you will have bugs!
My coworker and I are having a fist-fight civilized discussion over password security. Please help us resolve our differences.
One of us takes the viewpoint that:
Storing passwords encrypted using a public key in addition to a one-way hashed version is OK and might be useful for integration with other authentication systems in the future in case of a merger or acquisition.
Only the CEO/CTO would have access to the private key, and it would only be used when necessary. Regular login validation would still occur via the hashed password.
I have/he has done this before in previous companies and there are many sites out there that do this and have survived security audits from Fortune 500 companies before.
This is a common, and accepted practice, even for financial institutions, thus there is no need to explicitly state this in the privacy policy.
Sites like Mint.com do this.
The other one of us takes the following viewpoint:
Storing passwords, even in encrypted form, is an unnecessary security risk and it's better to avoid exposure to this risk in the first place.
If the private key falls into the wrong hands, users that use the same password across multiple sites would risk having all of their logins compromised.
This is a breach of trust of our users, and if this practice is implemented, they should be explicitly informed of this.
This is not an industry-wide practice and no big name sites (Google, Yahoo, Amazon, etc.) implement this. Mint.com is a special case because they need to authenticate with other sites on your behalf. Additionally, they only store the passwords to your financial institutions, not your password to Mint.com itself.
This is a red flag in audits.
Thoughts? Comments? Have you worked at an organization that implemented this practice?
The first practice of storing recoverable version of passwords is plain wrong. Regardless of the fact that big sites do this. It is wrong. They are wrong.
I automatically distrust any site that stores my password unhashed. Who knows what would happen if the employees of that big company decide to have fun? There was a case some guy from Yahoo stole and sold user emails. What if someone steals/sells the whole database with my emails and passwords?
There is no need whatsoever for you to know my original password to perform authentication. Even if you decide later to split the system, add a new one or integrate with a third party, you still will be fine with just a hash of the password.
Why should CEOs be more reliable / trustworthy than other people? There are example of high-ranking government people who have lost confidential data.
There's no reason a regular site has to store a password, not a single one.
What happens if in the future those private keys can be broken? What if the key used is a weak key, as has happened just recently in Debian.
The bottom line is: Why would one take such great risks for little to no benefit. Most companies aren't ever going to need an encrypted password.
Hash Passwords
Storing passwords in a reversible form is unnecessary and risky.
In my opinion, a security breach seems much more likely than the need to merge password tables. Furthermore, the cost of a security breach seems far higher than the cost of implementing a migration strategy. I believe it would be much safer to hash passwords irreversibly.
Migration Strategy
In case of a company merger, the original algorithm used to hash passwords can be noted in a combined password table, and different routines called to verify the passwords of different users, determined by this identifier. If desired, the stored hash (and its identifier) can be updated at this time too, since the user's clear-text password will be available during the login operation. This would allow a gradual migration to a single hash algorithm. Note that passwords should expire after some time anyway, so this would be upper bound on the time migration would require.
Threats
There are a couple of avenues to attack encrypted passwords:
The decryption key custodian could be corrupt. They could decrypt the passwords and steal them. A custodian might do this on his own, or he could be bribed or blackmailed by someone else. An executive without special training is especially susceptible to social engineering too.
An attack can also be made on the public key used for encryption. By substituting the real public key with one of their own, any of the application administrators would be able to collect passwords. And if only the CEO has the real decryption key, this is unlikely to be discovered for a long time.
Mitigation
Supposing this battle is lost, and the passwords are encrypted, rather than hashed, I'd fight on for a couple of concessions:
At the very least, the decryption key should require the cooperation of multiple people for recover. A key sharing technique like Shamir's secret sharing algorithm would be useful.
Measures to protect the integrity of the encryption key are required too. Storage on a tamper-proof hardware token, or using a password-based MAC may help.
and might be useful for integration
with other authentication systems in
the future
If there is no immediate need to store the password in a reversable encrypted format, don't.
I'm working in a financial institution and here the deal is: no one should ever know user's password, so the default and implemented policy used everywhere is: one way hashed passwords with a strong hashing algorithm.
I for once stand in favor of this option: you do not want to go into the trouble of handling the situation where you have lost your two-way encryption password or someone stole it and could read the stored passwords.
If somebody loses their password you just change it and give it to them.
If a company needs to merge, they HAVE to keep hashed passwords the way they are: security is above everything else.
Think about it this way: would you store your home keys in a box that has a lock with a key you have, or would you better prefer to keep them with you everytime?
In the first case: everybody could access your home keys, given the proper key or power to break the box, in the second case to have your keys a potential home-breaker should threaten you or take them from you in some way... same with passwords, if they are hashed on a locked DB it is like nobody has a copy of them, therefore no one can access your data.
I have had to move user accounts between sites (as might happen in a merger or acquisition) when the passwords were one-way hashed and it was not a problem. So I do not understand this argument.
Even if the two applications used different hashing algorithms, there will be a simple way to handle the situation.
The argument in favor of storing them seems to be that it might simplify integration in the case of a merger or acquisition. Every other statement in that side of the argument is no more than a justification: either "this is why it's not so bad" or "other people are doing it".
How much is it worth to be able to do automatic conversions that a client may not want done in event of merger or acquisition? How often do you anticipate mergers and/or acquisitions? Why would it be all that difficult to use the hashed passwords as they are, or to ask your customers to explicitly go along with the changes?
It looks like a very thin reason to me.
On the other side, when you store passwords in recoverable form there's always a danger that they'll get out. If you don't, there isn't; you can't reveal what you don't know. This is a serious risk. The CEO/CTO might be careless or dishonest. There might be a flaw in the encryption. There would certainly be a backup of the private key somewhere, and that could get out.
In short, in order to even consider storing passwords in recoverable form, I'd want a good reason. I don't think potential convenience in implementing a conversion that might or might not be required by a possible business maneuver qualifies.
Or, to put it in a form that software people might understand, YAGNI.
I would agree that the safest way remains the one-way hash (but with a salt of course!). I'd only resort to encryption when I'd need to for integrating with other systems.
Even when you have a built system that is going to need integration with other systems, it's best to ask your users for that password before integrating. That way the user feels 'in control' of his own data. The other way around, starting with encrypted passwords while the use is not clear to the end-user, will raise a lot of questions when you start integrating at some point in time.
So I will definitely go with one-way hash, unless there is a clear reason (clear development-wise and clear to the end-user!) that the unencrypted password is immediately needed.
edit:
Even when integration with other systems is needed, storing recoverable passwords still isn't the best way. But that of course, depends on the system to integrate with.
Okay first of all, giving the CEO/CTO access to plaintext passwords is just plain stupid. If you are doing things right, there is no need for this. If a hacker break your site, what's stopping him from attacking the CEO next?
Both methods are wrong.
Comparing the hash of a received password against a stored hash means the user sends his plaintext password on every login, a backdoor in your webapp will obtain this. If the hacker does not have sufficient privileges to plant a backdoor, he will just break the hashes with his 10K GPU botnet. If the hashes cannot be broken, it means they have collisions, which means you have a weak hash, augmenting a blind brute force attack by magnitudes. I am not exaggerating, this happens every day, on sites with millions of users.
Letting users use plaintext passwords to login to your site means letting them user the same password on every site. This is what 99% of all public sites do today, it is a pathetic, malicious, anti-evolutionary practice.
The ideal solution is to use a combination of both SSL client certificates and server certificates. If you do this correctly, it will render the common MITM/Phishing attack impossible; an attack of such could not be used against the credentials OR the session. Furthermore, users are able to store their client certificates on cryptographic hardware such as smart cards, allowing them to login on any computer without the risk of losing their credentials (although they'd still be vulnerable to session hijacking).
You make think I'm being unreasonable, but SSL client certificates were invented for a reason...
Every time I have anything to do with passwords they are one way hashed, with a changing salt i.e. hash(userId + clearPassword). I am most happy when no one at our company can access passwords in the clear.
If you're a fringe case, like mint.com, yes, do it. Mint stores your passwords to several other sites (your bank, credit card, 401k, etc), and when you login to Mint, it goes to all of those other sites, logs in via script as you, and pulls back your updated financial data into one easy-to-see centralized site. Is it tinfoil-hat secure? Probably not. Do I love it? Yes.
If you're not a fringe case, lord no, you shouldn't ever be doing this. I work for a large financial institution, and this is certainly not at all an accepted practice. This would probably get me fired.
I have an ASP.Net web application where I would like to implement cryptography for password security. I am not using SSL.
For that i studied and pick CRAM-MD5 algorithm for password authentication. I have implement javascript cram-md5 algorthim available at http://pajhome.org.uk/crypt/md5/
Here i would like to know that is there anyone used it and face that CRAM-MD5 authentication is decoded by hackers?
What are the possiblities of decoding CRAM-MD5 authentication?
MD5 is no longer considered secure, see MD5 vulnerabilities. For a more secure implementation, choose a different hash algorithm (such as SHA-256 or better).
For sure MD5 is no longer considered secure but the cryptanalysis vulnerabilities affecting him does not affect HMAC-MD5. It's a whole different beast.
I do agree that CRAM-MD5 would not be the best recommendation but it really has nothing to do with the insecurity of MD5.
Learn what's the difference.
See http://www.openauthentication.org/pdfs/Attacks%20on%20SHA-1.pdf, https://www.rfc-editor.org/rfc/rfc6151 and http://cseweb.ucsd.edu/~mihir/papers/hmac-new.html
Contrary to what others are saying, CRAM-MD5 is standard and safe to use. It's widely used in SASL for IMAP/SMTP authentication. You might be reading your EMail using CRAM-MD5. The other standard hashing algorithms are HTTP Digest Authentication and CHAP used in PPP but they all uses MD5 due to historical reasons. You can choose more secure SHA1-based hash but you will have to roll your own challenge schemes.
Because it uses challenge/response scheme, it's less vulnerable to the weakness of the MD5 hash. Unless you have special security requirements, stay with one of the standard algorithms.
Don't self implement your hashing algorithm. There are well tested implementations in System.Security. As stated don't use MD5.
In addition you should salt your hashes. For example if you have a user table with a password field you can add a salt field that is simply an integer, or a guid, or even a timestamp, but something unique. The salt ensures you will not have hash collisions within your database. Here is a discussion on salting.
Implementing your own cryptography is generally seen as a bad idea.
Cryptographic algorithms have a lot of very specific demands, and if even one of them isn't met (and that usually happens when people do their own), it usually won't be all too much more secure than no crypto at all.
If you're not convinced, this Google Tech Talk should help.
From Wiki:
Protocol Weaknesses
- No mutual authentication; client does not verify server.
- Offline dictionary attack to recover password feasible after capturing a successful CRAM-MD5 protocol exchange.
- Use of MD5 insufficient.
- Carries server requirement for storage of reversibly encrypted passwords.
I'd be scared to use md5 hashing algorithm, as getting back the original password from hash can be done in few seconds, if password wasn't long enough (actually, you can google for md5 rainbow table, there are sites that will decode such hash in few seconds and give back the result ;) ).
As others have advised; don't use MD5, ever, for anything.
But as to an actual answer, how badly is it broken:
Well, with any one-hash it's, well, one-way, so you can't 'decode' it in that sense. What you can do, however, is generate collisions much faster than is acceptable. This allows the attackers to force matches in things that wouldn't otherwise match. It makes any validation of inference of the type 'md5(this) = md5(that) so this = that' wrong. This breaks digital signatures, and all sorts of other things.
Stay away from MD5, in any form.
-- Edit
Oh, and just a note, that hashing the password is no replacement for SSL. SSL is used to ensure, to the client, that the site they are browsing is yours, and to protect general sending of data.
Hashing is about protecting your database from a possible compromise. (And you always need to hash with a salt; you store the salt right next to the username in the db).
There have been a couple of great discussions regarding salt best practices, and it seems the overwhelming recommendation is to generate a different salt for each password and store it alongside the password in the database.
However, if I understand the purpose of salt correctly, it is to reduce the chance that you will be compromised by rainbow table attacks. So, I understand that by storing it in the database it would be optimal to change it for each user, but what if the salt is nowhere near the database? If I store a single salt value in the code (which would on the web server be in a compiled dll), wouldn't that serve the same purpose if an attacker were to somehow gain access to the database? It would seem to me to be more secure.
The value of a salt lies in it being different for each user. You also need to be able to retrieve this non-unique value when you're re-creating the hashed value for comparison purposes.
If you store a single salt value that you use for every password, then you massively reduce the value of having a salt in the first place.
The purpose of a salt is to require the regeneration of a rainbow table per password. If you use a single salt, the hacker/cracker only has to regenerate the rainbow table once and he has all your passwords. But if you generate a random one per user, he has to generate one per user. Much more expensive on the hackers part. This is why you can store a salt in plain text, it doesn't matter if the hacker knows it as long as there's more than one.
Security by obscurity is not good, microsoft has taught us that.
... until the attacker gains access to the DLL.
In addition to other answers, it's also worth noting that an attacker could figure out your salt in the same way he would figure out a password: Given a known password (his own), he can do a brute force attack on possible salts.
The lesson I learned from salts is: Divide and Conquer (security)