password encryption

[JeremyH]

Hi everyone,

 

Just was wondering what the best way of encrypting a password would be? I looked through the forums and found there where contradicting answers. I will be adding a salt too.

 

I have been told that a good method to make it more secure is too encrypt the salt, is this good?

 

Thanks,

 

JeremyH

[gizmola]

Ask a few people you will get a few different answers.  This topic has been beaten to death in numerous other threads.

 

-Use a hash.  A hash is not encryption.  It can not be decrypted.  That is the strength in using it.  The most commonly used hashes are md5() and sha1().    Since you brought up a salt, a hash is where a salt comes into play. 

-Yes use a salt.  And use a different salt for each row (saved in a seperate column for that purpose).  The point of a salt is that *if* your database were to be entirely compromised and someone was to have access to the complete database, using a salt for every different row makes the creation of a custom rainbow table pointless.  That is not to say that if there is one single account that they are interested in, they couldn't generate a custom rainbow table using that salt, but what ends up being impractical is generating a rainbow table in the hopes of getting hits on a number of different accounts.  It really doesn't matter what a salt is in this case -- but you want it to be random gibberish. 

 

One important thing to do is to enforce good passwords.  Require them to be a certain length, include numbers and/or special characters, and in general don't let people use simple words or their email address, login names etc.  This has nothing to do with encryption but is another hedge against disclosure after compromise, which assumes the worst.

 

One other thing to do, is make sure that your system detects bad passwords.  After a certain number of bad passwords are attempted within a short period of time, you should add additional barriers (different approaches include requiring a  captcha, slowing the attempt by a factor of seconds per bad attempt, or locking the account for a period of time after some reasonable threshold of consecutive bad attempts has been made.  This dissuades bot driven brute force hacking.

[JeremyH]

Thanks very much mate!

 

Have the md5 with an added salt to the end of it =)

 

Was just wondering weather it is a good idea to hash the salt to add in even more security? Or would it be a bad idea?

 

Thanks again!

 

JeremyH

[xyph]

Use something slower than md5.

 

Low-mid level graphics cards can hash over 1billion md5's a second.

 

SHA256 or SHA512 are much slower

[gizmola]

Use something slower than md5.

 

Low-mid level graphics cards can hash over 1billion md5's a second.

 

SHA256 or SHA512 are much slower

 

How is that helpful?

[gizmola]

Thanks very much mate!

 

Have the md5 with an added salt to the end of it =)

 

Was just wondering weather it is a good idea to hash the salt to add in even more security? Or would it be a bad idea?

 

Thanks again!

 

JeremyH

 

It doesn't matter whether you hash the salt or not.  What's important is that when you hash the password, you add the salt to the plaintext: 

 

$savedpw = md5($pw . $salt);

[JeremyH]

Cool! Thanks very much for your help mate!! =)

Have a good day!

 

JeremyH

[xyph]

Isn't PBKDF based around slowing down the attack over many, many iterations?

 

Speed makes a difference, and oddly, it's slower is better in this case.