Solved

Securely storing user passwords

Posted on 2009-05-19
3
217 Views
Last Modified: 2012-05-07
I'm considering how to secure passwords.
Please correct me if anything appears wrong, or add things if I've missed something.

1) Store the salt in a different place(database) than the password hashes. If password hashes are stolen, salt isn't necessarily.
2) Use sha1() instead of md5() for hashes. (Storing in mysql) because sha is more resource-consuming to break than md5s.
3) What considerations should be made when choosing a salt?
4) Would it in any way make sense to trunc the sha's to 32 chars, making them look like a md5 hash?
0
Comment
Question by:letharion
  • 2
3 Comments
 
LVL 6

Author Comment

by:letharion
ID: 24419703
Also, if one stores sha(username + password + salt), two users can have the same password, and still not the same hash. A good idea?
0
 
LVL 7

Accepted Solution

by:
askb earned 500 total points
ID: 24447695
1. Storing salts separatly in a different database does not increase the strength of the password / hash. Only the output hash/digest needs to be stored in the db for verifying the user. Note: that another added security - if you are using something like md5sum - would be that the added advantage of have the digest/hash in the database would also imply that the attacker would have to reverse the hash string to a string which equates to "pwd + salt". This would be same as finding an invariable length input string given and variable length output 128 bit hash.

2. yes - sha1 is better, and if you are considering some PKI stuff you could also try HMAC

3. Salt - can be master password/pin or any random bytes. This is what my scripts do:
md5sum(User ID + Pass + Master Pass (SALT)) = hash
NOTE: Salt can be a secondary pass or a pin number
Salts have many uses - http://en.wikipedia.org/wiki/Salt_(cryptography)

4. Not advisable - as you would be increasing the possibilies for a collision.   Assume that
1. sha1(a+B+C) = 4e1243bd22c66e76c2ba9eddc1f91394e57f9f83
2. sha1(ZZZ+B+C) = 4e1243bd22c66e76c2ba9eddc1f91394e57f9f82

Now if 1 and 2 gets truncated would be = 4e1243bd22c66e76c2ba9eddc1f91, see that last bit/char out the output digest could be diffirent.
0
 
LVL 6

Author Comment

by:letharion
ID: 24466306
That pretty much answers my question :)

Thank you very much.
0

Featured Post

How your wiki can always stay up-to-date

Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
- Increase transparency
- Onboard new hires faster
- Access from mobile/offline

Join & Write a Comment

It’s a strangely common occurrence that when you send someone their login details for a system, they can’t get in. This article will help you understand why it happens, and what you can do about it.
This article explains in simple steps how to renew expiring Exchange Server Internal Transport Certificate.
Sending a Secure fax is easy with eFax Corporate (http://www.enterprise.efax.com). First, Just open a new email message.  In the To field, type your recipient's fax number @efaxsend.com. You can even send a secure international fax — just include t…
This tutorial demonstrates a quick way of adding group price to multiple Magento products.

706 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

19 Experts available now in Live!

Get 1:1 Help Now