Password Hashing

Cryptography · Axiom Academy

Protecting user credentials with cryptographically secure password storage techniques 1. Why Regular Hashes Are Dangerous for Passwords Using fast cryptographic hashes like SHA-256 for passwords creates two major vulnerabilities: Rainbow Tables: Precomputed tables that map common passwords to their hashes, enabling instant lookups Brute Force Speed: Modern GPUs can compute billions of hashes per second 2. Salt: Making Every Hash Unique A salt is a random value prepended to each password before hashing. This ensures that even identical passwords produce different hashes. Generate a random salt (typically 16-32 bytes) Store both the salt and hash (salt doesn't need to be secret) 3. Key Stretching: Intentional Slowness Even with salt, fast hash functions enable brute force attacks. Key stretching applies the hash function thousands of times, making each attempt computationally expensive. Legitimate use: Hash password once per login (~100ms impact) Attacker: Must hash billions of guesses (~1000× slower) 4. bcrypt: Adaptive Blowfish-Based Hashing bcrypt is based on the Blowfish cipher with a configurable "cost factor" that determines iteration count. As hardware improves, you can increase the cost to maintain security. 5. scrypt: Memory-Hard Hashing scrypt is designed to be memory-hard, requiring large amounts of RAM to compute. This makes GPU and ASIC attacks much more expensive than CPU-only attacks. 6. Argon2: Modern Gold Standard

This is the written version of the interactive lesson above. See the full Cryptography course.