Application Security // Database Security
06:31 AM
Connect Directly

Moving Away From Rash Hashing Decisions

Black Hat talk will discuss shortcomings of the latest technical evolution of hashing passwords for safe storage in databases, propose a competition to design something better

The past few years have been a bonanza for password breaches as poor deployment or nonexistent encryption practices combined with database and Web application vulnerabilities to SQL injection continue to catch up with organizations. Some organizations are storing passwords in the clear. Others encrypt their passwords but hash them in ways that they're easily brute-forced by attackers who stumble into hash repositories via SQLi attacks or other means.

Click here for more of Dark Reading's Black Hat articles.

Take LinkedIn, for instance. Prior to last year'sbreach of more than 6 million passwords at the site, one would expect such a high-profile service to protect user passwords in a pretty reasonable way, says Jean-Philippe Aumasson, principal cryptographer at Kudelski Security in Switzerland and a well-regarded expert in cryptography and cryptanalysis.

"Actually, that was not the fact. They used a very weak password protection method. They used SHA-1," he says, referring to the hash function algorithm that has been advised against due to its crackability for some time now, but which is still in wide use. "They used it in a very simplistic way, and the result of this is out of the 6 million passwords hashes leaked, due to weaknesses of the protection, state-of-the-art cracking techniques could recover the passwords of all the users tied to those hashes."

Sure, there are alternatives out there for salting hashes and making them difficult to crack. Aumasson says that the traditional approach from cryptographers hearing about cases like LinkedIn is to blame the developers for failing to implement the most advanced encryption technology in a competent way. The knee-jerk reaction is to think app developers or database security pros are too stupid to implement them. But the truth is that the encryption methods out there are not elegant and they're not easy to implement without specialized knowledge, he says. DBAs and developers are smart, but their specialty is somewhere else outside of cryptography.

In an upcoming talk at Black Hat next week, Aumasson will propose that it's time to stop the blame game. Together with an industry coalition of 19 other experts in cryptography, he's announcing a new competition in search of a more user-friendly means of password hashing that uses the theoretical principles behind the most advanced means of hashing available today without all of the complicated baggage that makes it hard for normal IT practitioners, like developers and DBAs, to implement.

"If we think about it, why do we end up in these situations where many high-profile services use weak protections?" Aumasson says. "The experts know how to get this right, but for a normal developer it is very difficult to figure out what to use and how to use it in a secure way."

Created in the same vein as competitions run by NIST to come up with the impending SHA-3 algorithm for hash functions, the Password Hashing Competition puts it out to the technical community at large to develop the best possible scheme for thwarting cracking techniques like rainbow tables and the use of graphical processing units to brute-force password hashes. Aumasson says that simple salting of hashes can be defeated, but advanced tools that implement salted hashes with an eye toward requiring a greater computational cost for brute forcers are either ineffective in preventing GPU computational crunching or ungainly to use. For example, he holds scrypt as the most evolved method thus far, which was designed to counter the efficiency of cracking code by imposing the use of large amounts of memory.

"The motivation behind this is the hardware of the attackers -- the graphic cards and programmable hardware -- becomes much less efficient if they have to use that amount of memory. That's design in direct response to the attacker," Aumasson says,"but the design of scrypt is not optimal."

As he explains, scrypt requires things like implementing another layer of hashing function as a subroutine of the system, and that it is difficult to parameterize.

"If I'm not a cryptographer and I'm creating a new Web service, I have no guidance or recommendation on how to use this system," he says, explaining that's why it is so rarely used. This is where the competition comes into play. "We want to solve the problem altogether by creating something that embodies these ideas of something slower and more difficult for the attacker, but that is much easier to implement, much easier to use. We don't want to just fix the existing algorithm. We want to learn from it and to design something much better."

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message. Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading.  View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Current Issue
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
Published: 2015-04-24
Multiple cross-site request forgery (CSRF) vulnerabilities in Zen Cart 1.3.9h allow remote attackers to hijack the authentication of administrators for requests that (1) delete a product via a delete_product_confirm action to product.php or (2) disable a product via a setflag action to

Published: 2015-04-24
Multiple cross-site request forgery (CSRF) vulnerabilities in TinyWebGallery (TWG) before 1.8.8 allow remote attackers to hijack the authentication of administrators for requests that (1) add a user via an adduser action to admin/index.php or (2) conduct static PHP code injection attacks in .htusers...

Published: 2015-04-24
Multiple cross-site scripting (XSS) vulnerabilities in TinyWebGallery (TWG) before 1.8.8 allow remote attackers to inject arbitrary web script or HTML via the (1) selitems[] parameter in a copy, (2) chmod, or (3) arch action to admin/index.php or (4) searchitem parameter in a search action to admin/...

Published: 2015-04-24
Multiple stack-based buffer overflows in HttpUtils.dll in TVMOBiLi before allow remote attackers to cause a denial of service (tvMobiliService service crash) via a long string in a (1) GET or (2) HEAD request to TCP port 30888.

Published: 2015-04-24
Red Hat JBoss Operations Network 3.3.1 does not properly restrict access to certain APIs, which allows remote attackers to execute arbitrary Java methos via the (1) ServerInvokerServlet or (2) SchedulerService or (3) cause a denial of service (disk consumption) via the ContentManager.

Dark Reading Radio
Archived Dark Reading Radio
Join security and risk expert John Pironti and Dark Reading Editor-in-Chief Tim Wilson for a live online discussion of the sea-changing shift in security strategy and the many ways it is affecting IT and business.