RE: Hashing passwords

["Liam Randall" <Liam.Randall () gigaco com>]

The largest problem is simply the hash algorithm.  With hashcat and $100 graphics card you can brute an insane amount 
of passwords.  MD5 and SHA1 are broken in that they are too easy to compute.  

Secure hashes are designed to be slow; where slow means it takes a relatively large amount of cpu/gpu cycles to compute 
them.

Check out bcrypt:

http://en.wikipedia.org/wiki/Bcrypt

Martin Boss (Purehate) has a ton of great presentations floating around from conferences where he takes you through it.

Liam Randall

-----Original Message-----
From: listbounce () securityfocus com [mailto:listbounce () securityfocus com] On Behalf Of Rory Browne
Sent: Monday, June 11, 2012 2:32 PM
To: Ansgar Wiechers
Cc: security-basics () securityfocus com
Subject: Re: Hashing passwords

I think the issue here, is that if my password is 'asdf'  ( it isn't ), then the sha1 hash will be 
'3da541559918a808c2402bba5012f6c60b27661c'. This means that someone can create a table mapping  
'3da541559918a808c2402bba5012f6c60b27661c'
to 'asdf'. This kind of table is called a rainbow table.

I don't think it's of much benefit hashing more than once. If that was the standard practice, then an attacker instead 
would map '30a518b67dcd7af15b369ccb1518ab3cad8e8b2c' ( 'asdf' sha1-hashed twice
) to 'asdf'.

I imagine including the username and org in the hash would improve the situation ( in which case, you would hash a 
concatenation of the username, password, and org ). Does anyone know of any security problem, where instead of salting 
with a random number ( which IIUC would need to be stored as well ), the hash was salted with the username and the org. 
That way, two different users with the same password would have different hashes, and the hashes would also be 
different from any other system.

Rory

On 11 June 2012 18:55, Ansgar Wiechers <bugtraq () planetcobalt net> wrote:
> On 2012-06-11 haZard0us wrote:
> > This may well be a silly question but, with this recent hashed 
> > password leakage, I want to ask something about properly hashing.
> >
> > The "manuals" say that we should create a salt and then hash it. But, 
> > since calculating an hash is a "relative simple" operation (in matter 
> > of processing power), is hashing two or three times the password 
> > (hash over hash) a "kind of" secure method or it is as weak as not 
> > using salt at all?
> >
> > It can still be cracked but...
>
> Yes, it can still be cracked. However, salting passwords defeats the 
> advantages gained from using rainbow tables, so cracking the password 
> will still take a significantly longer time than it would for an 
> unsalted password.
>
> Regards
> Ansgar Wiechers
> --
> "All vulnerabilities deserve a public fear period prior to patches 
> becoming available."
> --Jason Coombs on Bugtraq
>
> ----------------------------------------------------------------------
> -- Securing Apache Web Server with thawte Digital Certificate In this 
> guide we examine the importance of Apache-SSL and who needs an SSL certificate.  We look at how SSL works, how it 
> benefits your company and how your customers can tell if a site is secure. You will find out how to test, purchase, 
> install and use a thawte Digital Certificate on your Apache web server. Throughout, best practices for set-up are 
> highlighted to help you ensure efficient ongoing management of your encryption keys and digital certificates.
>
> http://www.dinclinx.com/Redirect.aspx?36;4175;25;1371;0;5;946;e13b6be4
> 42f727d1
> ----------------------------------------------------------------------
> --

------------------------------------------------------------------------
Securing Apache Web Server with thawte Digital Certificate In this guide we examine the importance of Apache-SSL and 
who needs an SSL certificate.  We look at how SSL works, how it benefits your company and how your customers can tell 
if a site is secure. You will find out how to test, purchase, install and use a thawte Digital Certificate on your 
Apache web server. Throughout, best practices for set-up are highlighted to help you ensure efficient ongoing 
management of your encryption keys and digital certificates.

http://www.dinclinx.com/Redirect.aspx?36;4175;25;1371;0;5;946;e13b6be442f727d1
------------------------------------------------------------------------


------------------------------------------------------------------------
Securing Apache Web Server with thawte Digital Certificate
In this guide we examine the importance of Apache-SSL and who needs an SSL certificate.  We look at how SSL works, how 
it benefits your company and how your customers can tell if a site is secure. You will find out how to test, purchase, 
install and use a thawte Digital Certificate on your Apache web server. Throughout, best practices for set-up are 
highlighted to help you ensure efficient ongoing management of your encryption keys and digital certificates.

http://www.dinclinx.com/Redirect.aspx?36;4175;25;1371;0;5;946;e13b6be442f727d1
------------------------------------------------------------------------