phc-discussions - Re: [PHC] Re: [Cryptography] The proper way to hash password files

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAELGc4X_OVGfn9xX2hc39_RZWV9Q=GhB-aZVk=93uskhdJHR5A@mail.gmail.com>
Date: Tue, 27 May 2014 05:13:25 +0800
From: Hongjun Wu <wuhongjun@...il.com>
To: discussions@...sword-hashing.net
Cc: Phillip Hallam-Baker <phill@...lambaker.com>, 
	"cryptography@...zdowd.com" <cryptography@...zdowd.com>
Subject: Re: [PHC] Re: [Cryptography] The proper way to hash password files

I think that a general way to protect password file is to hash passwords
(like the Password Hashing competition).

But a strong way to protect passwords is to use MAC (much more secure than
using hash if the MAC operation is done in a separate hardware chip).  I
have talked about the advantage of using MAC to protect password web
authentication in my first post in the PHC discussion forum.  My idea is
similar to that of Phillip Hallam-Baker, except that I think a salt is
still useful even when MAC is used.

If MAC is used, even the weak passwords can be well protected (i.e., they
cannot be recovered directly from the password file).

Best Regards,
hongjun

On Mon, May 26, 2014 at 11:17 PM, Yann Droneaud <ydroneaud@...eya.com>wrote:

> Le jeudi 22 mai 2014 à 13:09 -0400, Phillip Hallam-Baker a écrit :
> > Lots of sackcloth and ashes as EBay loses a password file.
> >
> > It occurs to me that most of the time, machines do password files
> > wrong. Rather than using a salted hash, a better approach would be to
> > use a MAC with a randomly chosen key that is never disclosed.
> >
> > Now this seems obvious but I can't recall ever seeing code set up to
> > do the job this way...
>
> The proper way to hash passwords is at https://password-hashing.net/
>
> (or someone was late to submit her proposal !)
>
> Regards.
>
> --
> Yann Droneaud
> OPTEYA
>
>
>

Content of type "text/html" skipped