Security Basics mailing list archives
RE: Hashing passwords
From: "Liam Randall" <Liam.Randall () gigaco com>
Date: Tue, 12 Jun 2012 09:54:32 -0400
The largest problem is simply the hash algorithm. With hashcat and $100 graphics card you can brute an insane amount of passwords. MD5 and SHA1 are broken in that they are too easy to compute. Secure hashes are designed to be slow; where slow means it takes a relatively large amount of cpu/gpu cycles to compute them. Check out bcrypt: http://en.wikipedia.org/wiki/Bcrypt Martin Boss (Purehate) has a ton of great presentations floating around from conferences where he takes you through it. Liam Randall -----Original Message----- From: listbounce () securityfocus com [mailto:listbounce () securityfocus com] On Behalf Of Rory Browne Sent: Monday, June 11, 2012 2:32 PM To: Ansgar Wiechers Cc: security-basics () securityfocus com Subject: Re: Hashing passwords I think the issue here, is that if my password is 'asdf' ( it isn't ), then the sha1 hash will be '3da541559918a808c2402bba5012f6c60b27661c'. This means that someone can create a table mapping '3da541559918a808c2402bba5012f6c60b27661c' to 'asdf'. This kind of table is called a rainbow table. I don't think it's of much benefit hashing more than once. If that was the standard practice, then an attacker instead would map '30a518b67dcd7af15b369ccb1518ab3cad8e8b2c' ( 'asdf' sha1-hashed twice ) to 'asdf'. I imagine including the username and org in the hash would improve the situation ( in which case, you would hash a concatenation of the username, password, and org ). Does anyone know of any security problem, where instead of salting with a random number ( which IIUC would need to be stored as well ), the hash was salted with the username and the org. That way, two different users with the same password would have different hashes, and the hashes would also be different from any other system. Rory On 11 June 2012 18:55, Ansgar Wiechers <bugtraq () planetcobalt net> wrote:
On 2012-06-11 haZard0us wrote:This may well be a silly question but, with this recent hashed password leakage, I want to ask something about properly hashing. The "manuals" say that we should create a salt and then hash it. But, since calculating an hash is a "relative simple" operation (in matter of processing power), is hashing two or three times the password (hash over hash) a "kind of" secure method or it is as weak as not using salt at all? It can still be cracked but...Yes, it can still be cracked. However, salting passwords defeats the advantages gained from using rainbow tables, so cracking the password will still take a significantly longer time than it would for an unsalted password. Regards Ansgar Wiechers -- "All vulnerabilities deserve a public fear period prior to patches becoming available." --Jason Coombs on Bugtraq ---------------------------------------------------------------------- -- Securing Apache Web Server with thawte Digital Certificate In this guide we examine the importance of Apache-SSL and who needs an SSL certificate. We look at how SSL works, how it benefits your company and how your customers can tell if a site is secure. You will find out how to test, purchase, install and use a thawte Digital Certificate on your Apache web server. Throughout, best practices for set-up are highlighted to help you ensure efficient ongoing management of your encryption keys and digital certificates. http://www.dinclinx.com/Redirect.aspx?36;4175;25;1371;0;5;946;e13b6be4 42f727d1 ---------------------------------------------------------------------- --
------------------------------------------------------------------------ Securing Apache Web Server with thawte Digital Certificate In this guide we examine the importance of Apache-SSL and who needs an SSL certificate. We look at how SSL works, how it benefits your company and how your customers can tell if a site is secure. You will find out how to test, purchase, install and use a thawte Digital Certificate on your Apache web server. Throughout, best practices for set-up are highlighted to help you ensure efficient ongoing management of your encryption keys and digital certificates. http://www.dinclinx.com/Redirect.aspx?36;4175;25;1371;0;5;946;e13b6be442f727d1 ------------------------------------------------------------------------ ------------------------------------------------------------------------ Securing Apache Web Server with thawte Digital Certificate In this guide we examine the importance of Apache-SSL and who needs an SSL certificate. We look at how SSL works, how it benefits your company and how your customers can tell if a site is secure. You will find out how to test, purchase, install and use a thawte Digital Certificate on your Apache web server. Throughout, best practices for set-up are highlighted to help you ensure efficient ongoing management of your encryption keys and digital certificates. http://www.dinclinx.com/Redirect.aspx?36;4175;25;1371;0;5;946;e13b6be442f727d1 ------------------------------------------------------------------------
Current thread:
- Hashing passwords haZard0us (Jun 11)
- Re: Hashing passwords Ansgar Wiechers (Jun 11)
- Re: Hashing passwords Rory Browne (Jun 11)
- RE: Hashing passwords Liam Randall (Jun 12)
- Re: Hashing passwords martin . mngoma (Jun 12)
- Re: Hashing passwords Kai Wirt (Jun 12)
- Re: Hashing passwords Kurt Buff (Jun 12)
- Re: Hashing passwords Ansgar Wiechers (Jun 13)
- Re: Hashing passwords Kurt Buff (Jun 13)
- Re: Hashing passwords Alexander Klimov (Jun 13)
- Re: Hashing passwords Rory Browne (Jun 11)
- RE: Hashing passwords Mikhail A. Utin (Jun 13)
- Re: Hashing passwords Kai Wirt (Jun 13)
- Re: Hashing passwords Ansgar Wiechers (Jun 11)
- Re: Hashing passwords gold flake (Jun 12)