1

Ok, so I understand why salting a password prior to hashing is such a good idea. The question is, normally people suggest appending or prepending the salt to the password, why not do both?

My thinking is, so if Mr hacker got hold of the DB and wants to get the password for person x, he thinks to himself, well most people suggest appending or prepending the salt, so lets do that.. He generates a rainbow table with of all the combinations of password + salt, and tries his luck. If that doesn't work he does the same but salt + password.

To make much it more difficult to do the attack why don't developers go the step further and do 'salt + password + salt', or 'reverse(salt) + password + salt', or you could be fancy and start cutting up the password/salt, start putting bits of salt here and there etc.

The only way the hacker would be able to find the password is if he has access to the source code (to know how the salt was weaved into the password prior to hashing)

A further note is, people suggest doing a minimum of 1000 iterations when key-stretching, again why not 1147, 1652, etc :)

A 2nd further note, when looking at a hash string, is it possible to work out the hashing function used?

7
  • There is no problem in guessing the hashing function used. It can be public. Please, what's the exact question ? Is it about why it's useless to lose time adding the salt at both ends ? Jun 27, 2012 at 18:03
  • Yes but when looking at a long hash string, can the hacker go 'oh they used MD5' or 'oh they used sha-512' etc.. if they can't they would have to make rainbow tables for all the 'proper' hashes; or they would have to look at the source code.
    – Metalstorm
    Jun 27, 2012 at 18:26
  • 2
    Yes, it's easy to distinguish hashes produced by MD5, SHA1, SHA512, etc. For example their length are different. But that's not at all a problem. You don't seem to grasp the difference there is between trying 3 algorithms instead of one and trying 2^128 more combinations (the usual numbers we deal with in cryptography). Jun 27, 2012 at 18:28
  • 3
    @Metalstorm Obviously they are because you seem to think there's any value whatsoever in security-by-obscurity, as opposed to security-by-hard-maths. The way you make something cryptographically secure is by having the attacker brute-force through a bigger search space. For this, you might as well make the salt bigger to get the same effect. (Or use a bigger hash function, or a less broken hash, or a random salt to get more bang for your buck.)
    – millimoose
    Jun 27, 2012 at 21:02
  • 3
    @Metalstorm Also, if you can leak your password database, it's not unthinkable you can leak your source code repository. You don't want to make recovering the passwords "mildly tricky", you want to make it computationally infeasible.
    – millimoose
    Jun 27, 2012 at 21:03

2 Answers 2

7

It's much easier to guess the manner in which the salt is applied than it is to brute for the passwords, especially in the cases in which the attacker has a database of hashed passwords and one known match (his own password). Even if he has no knowledge of it, he can simply use his known password and the known hash to brute force the salt and salting algorithm.

The same goes with the hashing algorithm. There are only a few unbroken hash functions, and the chances are that any competent administrator would be using one of those.

One of the premises of cryptography is that ALL of the information about the algorithms used is assumed to be public. You should not rely on attackers to be unable to break your system because you are using an obscure algorithm to hash things, because compared to the expense of brute forcing passwords on a compromised database like that, brute forcing every hash algorithm is very inexpensive.

If you distribute your program to users, they can figure out exactly how it hashes things by disassembling or debugging it. If it's a server program, they can break in with some other vulnerability, or they can buy/steal/acquire your software, or whatever. I would even go so far as to say that ALL GOOD CRYPTOGRAPHIC SOFTWARE IS OPEN SOURCE: even though the entire world knows how it works, its still not breakable.

What you are trying to rely upon is security by obscurity. Lots of people and companies have used this as a method of securing their products. The last big incident I can remember was when the source code of Symantec's PCAnywhere software was stolen. You might remember how that turned out. Moral of the story is it isn't secure if nobody knows how it works, its secure if EVERYONE knows how it works (and it's cryptographically sound).

2
  • Just because the hacker has his password + his hash + his salt, he cant work out how it was hashed surely?! Finding out that the hash was prepended or appended is easy in that case I know. But if the code does some bespoke weaving of salt + password they only way the hacker could then replicate the hash is to get hold of the source code?
    – Metalstorm
    Jun 27, 2012 at 18:30
  • 2
    I've updated my post. One thing you seem to be missing is that if a hacker has compromised your system, you must assume they have EVERYTHING. If your program is running when they break in, they can dump an image of it and reverse engineer it later, even without the source code, even without an executable on disk.
    – Wug
    Jun 28, 2012 at 21:01
0

Reverse engineering your code would not be too hard for a determained hacker, once that happens, every one of your passwords is now compromised.

You should use proven hashing techniques. Take, for example, something similar to the bcrypt algorithm. When you want to hash a password, go through the following steps:

  1. Generate a sufficiently strong random salt (16 - 32 bytes)
  2. Set a hash cost (15 - 20) (the larger the cost, the slower and stronger the hash)
  3. Calculate the number of hash rounds you will perform (2^cost)

Do the following:

hash = ""
for(numberOfHashRounds)
{
hash = SHA256(hash + salt + password)
}

Then store the hash along with the salt and cost used. When you need to verify, do the same with the stored salt and cost. As computers get faster, you can up the cost of the algorithm. Try and get it so your hash takes ~500ms to compute, or as long as you are willing to sacrafice.

This is secure because a cracker would have to generate a rainbow table for every salt, and perform the same number of rounds. This will take decades even with a GPU array used to crack.

If you want to add obfuscation on top of that, go ahead, just dont break the security of your algorithm in the process.

8
  • So you just described what key-stretching is, which is what I said... Also, i didn't ask if it was hard to reverse engineer the source code.
    – Metalstorm
    Jun 27, 2012 at 20:08
  • @Metalstorm your acting like your source code is super secret, which it's not, therefore your obfuscation is pointless. What more do you need to know?
    – Petey B
    Jun 27, 2012 at 20:10
  • Please go and re-read my post...I never said that the code is super secret and that no one will be able to reverse engineer it and work out how the salt is applied. The question is, following the steps i outlined, the a hacker would have to get the source code to be able to generate the matching hashes. IE, if the DB is compromised, they would have to get the source code as well... which can be at a different location.
    – Metalstorm
    Jun 27, 2012 at 20:26
  • 1
    Okay, so the answer would be, "Yes, but there is no point with a sufficiently strong, known to the attacker, hashing algorithm".
    – Petey B
    Jun 27, 2012 at 20:49
  • 2
    Impossible, assuming an attacker could never get your source code, which is a false assumption. Which brings me back to my point, obfuscate only after having a proven, secure, hashing algorithm.
    – Petey B
    Jun 28, 2012 at 3:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.