Definition
Password hashing transforms a plain text password into a fixed-length string of characters that looks random. This uses a one-way cryptographic hash function, making it nearly impossible to recover the original password.How It Works
- 1A user creates a password.
- 2A salt, a random value, is generated for that password.
- 3The password and salt are combined and processed by a hash function (e.g., bcrypt, scrypt, Argon2, PBKDF2).
- 4The function outputs a hash, stored in the database.
- 5To verify a password, the process is repeated, and the new hash is compared to the stored hash.
Key Characteristics
- One-way Function: Hash functions are irreversible.
- Unique Salt: Ensures different hashes for identical passwords.
- Adaptive: Modern algorithms (bcrypt, Argon2) adjust to computational power, maintaining security.
Comparison
| Feature | MD5/SHA1 | bcrypt/scrypt/Argon2 |
|---|---|---|
| Security Level | Low | High |
| Collision Resistance | Weak | Strong |
| Salting Requirement | Optional | Required |
Real-World Example
In 2012, LinkedIn experienced a breach where unsalted SHA1 password hashes were leaked, exposing millions of user credentials to rainbow table attacks (CVE-2012-2313).Detection & Prevention
- Use Strong Hash Functions: Utilize algorithms like bcrypt, scrypt, or Argon2.
- Add Salt and Pepper: Always use a unique salt and consider additional 'pepper' (a secret value).
- Regularly Update and Audit: Use tools such as OWASP ZAP or Burp Suite for security audits.
Common Misconceptions
- All Hash Functions Are Secure: Older functions like MD5 and SHA1 are vulnerable and should not be used.
- No Need for Salting: Salting is crucial to prevent attacks like rainbow tables.
- Hash Once, Secure Forever: Security requires ongoing updates and monitoring.