Password storage requires specialized cryptographic algorithms. In this brief, we analyze why standard fast hashes (like MD5 or SHA-256) are vulnerable and how to protect database credentials.
1. The Problem with Fast Hashes
Algorithms like SHA-256 are designed to calculate hash sums in nanoseconds. While perfect for file verification, this speed allows hardware devices to run trillions of password guesses per second during audits, making simple passwords easy to crack.
2. The Solution: Hashing Salt
A salt is a random string of characters appended to passwords before hashing.
- Each user account must have a unique, randomly generated salt.
- Even if two users share the same password, their hashes in the database will be completely different.
- Salting renders pre-computed Rainbow Tables useless, forcing attackers to guess passwords individually.
3. Key Stretching
Key stretching algorithms deliberately slow down hashing calculations (taking ~100ms per attempt) to block brute-force attacks.
- bcrypt: Uses the Blowfish block cipher, utilizing an adjustable cost parameter to control calculations work size.
- Argon2: The state-of-the-art password hashing standard, utilizing custom memory and CPU parameters to resist GPU/ASIC acceleration attacks.