Salting your Hashes: Modern Password Storage

Just a quick presentation for the Ohio InfoSec Forum holiday meeting.

Writing a web app? Storing user passwords? Don't ever store them in plain text, you already know this. But do you know how to securely hash them? Here's a very basic look at salted hashes and how they improve security.

Transcript

1. Salting your Hashes Modern Password Storage
2. Hashing Passwords (md5) Password1 = b1345a0ce47f743bc94c5e32cf547ac0 Passward1 = cac53f4007216840391e744dc29ebfd7 Don't use MD5, it's broken, and a very bad choice for secure hashing (it's too fast, fast is bad for password hashing). It's only used to show an example. tl;dr: Don't use MD5, use bcrypt or PBKDF2.
3. Cracking MD5 MD5 hashes are trivial to crack with modern graphics cards. Even worse, your hash can be looked up with Rainbow Tables in a matter of seconds. Hashing alone is very insecure. God forbid you actually store passwords in plain text…..
4. Salt? If just one character can change an entire hash, adding random junk can make cracking and rainbow tables harder to use. Salt is that random junk. SALT=`cat /dev/urandom | tr -dc 'a-zA-Z0-9-_!@#$%^&*()_+{}|:<>?='| head -c 16` echo "$SALT.Password1" | md5sum The SALT variable is set to 16 characters of random junk, then fed into the hash of the password. Changing it. You must store the SALT!
5. Storing Password Hashes Wrong Right Table: Users Username Salt SecureHash alice Jothuh6AeZo hw8ai 6cf73117b15 bea56e3f35e e2c59727f5 bob Jothuh6AeZo hw8ai 6cf73117b15 bea56e3f35e e2c59727f5 Table: Users Username Salt SecureHash alice Jothuh6AeZo hw8ai 6cf73117b15 bea56e3f35e e2c59727f5 bob ooTaez6ohP ee3eeg 167f722da71 78afb8aeaf7 a3de997a21 Don't use the same salt across users! Both users in this example are using the same password, using different salts will prevent one successful crack from affecting other users.
6. Hashes also help prevent Brute Force DB Cracking! Simply by increasing length: Normal password = Password1 9 Characters Hashed password = Jothuh6AeZohw8ai.Password1 26 Characters
7. The Easy Way Just use bcrypt to store your passwords! • Slow enough to be secure (GPUs won't help you much) • Salt is built right in! No need to make your own! • It's deemed to be cryptographically secure and is highly regarded by cryptographers all over the world.