Hi,
At the moment, Argon2 [1] is the current standard to significantly delay brute-force attempts. Generally, when auditing code bases, I tend to look for "don't use a single round of $ALGORITHM" and work from there upwards or downwards.
Key things I look for as an auditor:
- don't use a single round of $algorithm
- implementation (eg copy pasted code or system libraries or anything in between)
- maintenance/code quality (e.g. if there is a tendency to update the code base to newer standards etc)
When I run into hashes from an offensive security side, anything that's a complex function (ie. Not single round stuff) will make my life miserable. I have computing power available that could put me in the tail end of the TOP500 and things like bcrypt or PBKDF _will_ make my life miserable. When I run into things like that from my offensive security side, I just give up and look at easier ways to accomplish the end goal because credentials are just a means to an end.
I hope this helps.
/y
[1]
https://en.wikipedia.org/wiki/Argon2
-----Original Message-----
From: MIDRANGE-L <midrange-l-bounces@xxxxxxxxxxxxxxxxxx> On Behalf Of Patrik Schindler
Sent: 18 March 2021 14:28
To: Midrange Systems Technical Discussion <midrange-l@xxxxxxxxxxxxxxxxxx>
Subject: Re: How to validate passwords without storing them anywhere.
Hello Rob,
Am 18.03.2021 um 14:06 schrieb Rob Berendt <rob@xxxxxxxxx>:
But again, if you're using a known approved encryption, like bcrypt, and someone downloads the database, can't they just brute force it by hammering on bcrypt the same as brute force it by hammering on the sql function?
Yes, of course. Weak passwords from users stay weak passwords. Dictionary attacks are still possible: Trying out a large list of words and popular password strings (like the famous 12345) isn't hard.
Hashing instead of encryption prevents to recalculate the password from the string stored in the database, nothing more.
:wq! PoC
--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list To post a message email: MIDRANGE-L@xxxxxxxxxxxxxxxxxx To subscribe, unsubscribe, or change list options,
visit:
https://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx
Before posting, please take a moment to review the archives at
https://archive.midrange.com/midrange-l.
Please contact support@xxxxxxxxxxxxxxxxxxxx for any subscription related questions.
Help support midrange.com by shopping at amazon.com with our affiliate link:
https://amazon.midrange.com
midrange.com
