One Way Hashing Without Salt

1,811 views

Published on

I am taking a security class and everybody should prepare a presentation for a particular security threat and this is our topic.

Published in: Technology
0 Comments
0 Likes
Statistics
Notes
  • Be the first to comment

  • Be the first to like this

No Downloads
Views
Total views
1,811
On SlideShare
0
From Embeds
0
Number of Embeds
53
Actions
Shares
0
Downloads
9
Comments
0
Likes
0
Embeds 0
No embeds

No notes for slide

One Way Hashing Without Salt

  1. 1. One-way hashing without salt"Youre probably storing passwords incorrectly"
  2. 2. Storing user passwords● Plaintext● Hashed● Hashed with salt
  3. 3. 1. User creates an account, system stores the hash of the password 2. Attacker compromises the system and obtains the hash3. Attacker reverses the hashusing precomputed data andthus gains credentials to otheraccounts of the user
  4. 4. Prerequsities: Effects:● Weak user password ● Attacker gains (User) unauthorised access to● Hashing the passwords other systems directly (System) ○ User data, assets● Compromised system and reputation is (System) threathened● Same password on a ○ Integrity and security number of systems of accessed systems (User) is threatened
  5. 5. Vulnerable code:register_user(login, password): hash = sha.new(password).hexdigest() save_hash(login, hash)verify_credentials(login, password): hash = sha.new(password).hexdigest() if hash == load_hash(login): return Correct else return Incorrect
  6. 6. Better code:register_user(login, password): salt = sha.new(str(random.random())).hexdigest() hash = sha.new(password+salt).hexdigest() save_hash(login, hash) save_salt(login, salt)verify_credentials(login, password): salt = load_salt(login, salt) hash = sha.new(password+salt).hexdigest() if hash == load_hash(login): return Correct else return Incorrect
  7. 7. Defense measures:● Salt the passwords before hashing ○ Preferably with different salt for each password ○ Preferably with decent-length salt● Use specialised hashing algorithms that introduce work factor (such as bcrypt) instead of general ones (such as sha and md5) that are prone to bruteforce attack (with known hash and salt).
  8. 8. Q&A

×