Scrypt, Bcrypt or anything else

Question

I’m choosing a hash algorithm for passwords from a system I develop. At the beginning of my "programmatic" I used the MD5, the SHA-1 and its derivantes. After a while I preferred the Whirlpool and now I’m looking for something more robust.

I’m in doubt between the Scrypt and the others... About the Scrypt I didn’t like your leaving:

$s0$e0801$epIxT/h6HbbwHaehFnh/bw==$7H0...

because I found the split by dollar very evident to an attacker (at least it was the impression I had).

Today what would be the best way forward? Scrypt, Bcrypt or PBKDF2 or some other way?

After knowing the project Jasypt I preferred to return to the good old Whirlpool, I still intend to study the algorithms mentioned above, but for now I’m betting on Whirlpool.

Answer 1

About the dollar sign being obvious to an attacker: it doesn’t really mean anything. The security of your system lies in the difficulty of making the attack, not the difficulty of finding out which algorithm was used. For starters, any algorithm that has a faster attack than brute force is broken and should not be used.

Among the algorithms that do not have easy attack, ie, are only broken by brute force, security increases when more expensive (in time and money) is to make this brute force. And that’s where more time-consuming hash algorithms take advantage over fast hashes: an MD5 was created to be calculated quickly, and being "calculated quickly" is bad for security.

Of the 3 algorithms you mentioned, we can analyze:

• PBKDF2 : the number of iterations is configurable, that is, you can make it take longer to be processed. But since it requires few circuits for its processing and little RAM, it is possible to use video cards (Gpus) or programmable / optimized circuits (such as Asics). This way it is possible to make a low cost attack.

• Bcrypt : as it makes more intense use of RAM, the cost / difficulty of making a specific hardware to attack it is higher. In this way, it is dryer than PBKDF2. And it’s been in use for some time, which means its safety has been tested and hasn’t been broken. However, the amount of RAM that it uses is not yet gigantic, and therefore the cost of building hardware to break it is higher than that of PBKDF2, but it is not as big as that of Scrypt.

• Scrypt : Scrypt requires a large amount of memory for its calculation (nothing that an ordinary PC or server cannot provide, but large enough to disrupt the use of Gpus or dedicated hardware). As it is a newer algorithm, it did not spend the same time as Bcrypt being tested in real life, and so may have some flaw not yet discovered.

A rule to see which is best suited for your application: what would be the interest of someone investing money to break the security of your application? If it’s something that valuable (for example, bank security or Bitcoins), use the solution that is more expensive for the attacker (Scrypt). If you only need reasonable security, PBKDF2 or Bcrypt will be more than enough.

Answer 2

In a hash algorithm, only what is being hashed is secret. Everything else is public (salt, work factor, other parameters). These algorithms are designed to maintain pre-image resistance (i.e. from the hash if the password is discovered) even if everything else about it is known. Therefore, the fact that an attacker sees the dollar sign in the code is not relevant (even because by the time he got his hands on your bank he must already know everything about your system).

In addition, other hash algorithms (even "broken" ones like MD5) will also need at least one salt (to avoid Rainbow Tables), And that salt has to be stored somewhere, right? What difference does it make if it’s in the hash itself (separated by dollar sign) or another column in the same table (which the attacker already has)?

On which is the best algorithm of the three, see the other answers for a comparative. Personally, I believe that PBKDF2 with a high number of iterations should be sufficient to protect a password (but in reality the three are good enough). And if your system has high security requirements (such as those of a bank, or nearby) then consider using other means than the password to protect your customers' accounts (two-factor authentication, for example).

Updating: Let’s say, to make life more difficult for an attacker, you solve: 1) take the dollar out; 2) change the order of the elements. That way, you’re turning:

$s0$e0801$epIxT/h6HbbwHaehFnh/bw==$7H0vsXlY8UxxyW/BWx/9GuY7jEvGjT71GFd6O4SZND0=

in

e0801s07H0vsXlY8UxxyW/BWx/9GuY7jEvGjT71GFd6O4SZND0=epIxT/h6HbbwHaehFnh/bw==

What the attacker will do?

1. Create an account on your site. So he will know 1 password (his own) and the corresponding hash;

2. Read how scrypt works, discovering that he has:

   1. A version number. How many s0 have in your string? Only 1:

      e0801  s0  7H0vsXlY8UxxyW/BWx/9GuY7jEvGjT71GFd6O4SZND0=epIxT/h6HbbwHaehFnh/bw==
      

   2. The parameters of the algorithm. Well, in this case it’s obvious that it’s the first group;

   3. A salt and a key. Well, in this case it was easy because the coding Base64 ended with = and ==, then it’s easy to find the pieces.

      e0801  s0  7H0vsXlY8UxxyW/BWx/9GuY7jEvGjT71GFd6O4SZND0=  epIxT/h6HbbwHaehFnh/bw==
      

3. What is the salt and what is the key? Well, he knows his own password and her hash, so just do 2 tests:

   $s0$e0801$epIxT/h6HbbwHaehFnh/bw==$7H0vsXlY8UxxyW/BWx/9GuY7jEvGjT71GFd6O4SZND0=
   
   $s0$e0801$7H0vsXlY8UxxyW/BWx/9GuY7jEvGjT71GFd6O4SZND0=$epIxT/h6HbbwHaehFnh/bw==
   

   Whatever works, it’s the format you’re using!

Although you use base 16 to make it harder to find the boundaries between the parts, the work to test all possibilities (within the same hash representation) is minimal compared to the work of trying to break the hash. If the attacker has enough money to make a hash attack, he can make that little test in a matter of minutes. You only complicated your implementation in exchange for a few minutes of the attacker’s time. It was worth it?

Answer 3

It depends on your goal. There are a number of things to evaluate:

• Time for password breaking using brute force;
• Number of iterations to generate an encrypted string;
• Number of characters in your password. For example, Bcrypt does not work with more than 55 characters.

The recommended is the PBKDF2, since you didn’t like the way out of Scrypt. It has no character limit. It is easier to break than the other two, but has a better performance. Below is a comparative table with the cost in attempts to break the password of each algorithm: