Moving Away From Rash Hashing Decisions

The past few years have been a bonanza for password breaches as poor deployment or nonexistent encryption practices combined with database and Web application vulnerabilities to SQL injection continue to catch up with organizations. Some organizations are storing passwords in the clear. Others encrypt their passwords but hash them in ways that they're easily brute-forced by attackers who stumble into hash repositories via SQLi attacks or other means.

Take LinkedIn, for instance. Prior to last year'sbreach of more than 6 million passwords at the site, one would expect such a high-profile service to protect user passwords in a pretty reasonable way, says Jean-Philippe Aumasson, principal cryptographer at Kudelski Security in Switzerland and a well-regarded expert in cryptography and cryptanalysis.

"Actually, that was not the fact. They used a very weak password protection method. They used SHA-1," he says, referring to the hash function algorithm that has been advised against due to its crackability for some time now, but which is still in wide use. "They used it in a very simplistic way, and the result of this is out of the 6 million passwords hashes leaked, due to weaknesses of the protection, state-of-the-art cracking techniques could recover the passwords of all the users tied to those hashes."

Sure, there are alternatives out there for salting hashes and making them difficult to crack. Aumasson says that the traditional approach from cryptographers hearing about cases like LinkedIn is to blame the developers for failing to implement the most advanced encryption technology in a competent way. The knee-jerk reaction is to think app developers or database security pros are too stupid to implement them. But the truth is that the encryption methods out there are not elegant and they're not easy to implement without specialized knowledge, he says. DBAs and developers are smart, but their specialty is somewhere else outside of cryptography.

In an upcoming talk at Black Hat next week, Aumasson will propose that it's time to stop the blame game. Together with an industry coalition of 19 other experts in cryptography, he's announcing a new competition in search of a more user-friendly means of password hashing that uses the theoretical principles behind the most advanced means of hashing available today without all of the complicated baggage that makes it hard for normal IT practitioners, like developers and DBAs, to implement.

"If we think about it, why do we end up in these situations where many high-profile services use weak protections?" Aumasson says. "The experts know how to get this right, but for a normal developer it is very difficult to figure out what to use and how to use it in a secure way."

Created in the same vein as competitions run by NIST to come up with the impending SHA-3 algorithm for hash functions, the Password Hashing Competition puts it out to the technical community at large to develop the best possible scheme for thwarting cracking techniques like rainbow tables and the use of graphical processing units to brute-force password hashes. Aumasson says that simple salting of hashes can be defeated, but advanced tools that implement salted hashes with an eye toward requiring a greater computational cost for brute forcers are either ineffective in preventing GPU computational crunching or ungainly to use. For example, he holds scrypt as the most evolved method thus far, which was designed to counter the efficiency of cracking code by imposing the use of large amounts of memory.

"The motivation behind this is the hardware of the attackers -- the graphic cards and programmable hardware -- becomes much less efficient if they have to use that amount of memory. That's design in direct response to the attacker," Aumasson says,"but the design of scrypt is not optimal."

As he explains, scrypt requires things like implementing another layer of hashing function as a subroutine of the system, and that it is difficult to parameterize.

"If I'm not a cryptographer and I'm creating a new Web service, I have no guidance or recommendation on how to use this system," he says, explaining that's why it is so rarely used. This is where the competition comes into play. "We want to solve the problem altogether by creating something that embodies these ideas of something slower and more difficult for the attacker, but that is much easier to implement, much easier to use. We don't want to just fix the existing algorithm. We want to learn from it and to design something much better."

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.