Password hashing

Password hashing converts a password into a fixed-length string of characters that appears random. The primary purpose is to protect passwords at rest: if a database is breached, an attacker obtains only the hashes, not the plaintext. Because hashing is one-way, the original password cannot be directly recovered from the hash. However, without additional measures, hashes are vulnerable to dictionary attacks, where an attacker precomputes hashes of common passwords and compares them against the stolen hashes. To mitigate this, a unique salt is prepended or appended to each password before hashing, ensuring that identical passwords produce different hashes across users. Additionally, modern algorithms are designed to be computationally expensive, slowing down brute-force attempts. The security of a password hashing scheme depends on the algorithm's resistance to both time-memory trade-offs and side-channel attacks.

The earliest widely used password hash was the Unix crypt() function, introduced in 1976, which used DES with a 12-bit salt and was fast enough for the era. As hardware improved, faster hashes like MD5 and SHA-1 were adopted, but they proved inadequate due to their speed and lack of salt. In 1999, bcrypt was introduced, incorporating a cost factor that makes it deliberately slow. In 2009, scrypt was designed to require significant memory, making it harder to attack with custom hardware. In 2015, Argon2 won the Password Hashing Competition and is now recommended by OWASP and NIST. Argon2id, a variant, provides both side-channel and GPU resistance. Other notable algorithms include PBKDF2, which is widely used in standards like WPA2 and iOS, and the newer Catena and Balloon hashing, which offer additional resistance to cache-timing attacks.

Best practices for password hashing are codified in guidelines from NIST SP 800-63B and the OWASP Password Storage Cheat Sheet. Key recommendations include using a strong, adaptive algorithm such as Argon2id, bcrypt, or PBKDF2 with a work factor that is regularly tuned to hardware improvements. Each password must be salted with a cryptographically secure random value of at least 16 bytes. The hash should be stored in a format that includes the algorithm, cost parameters, and salt, such as the Modular Crypt Format. Additionally, organizations should implement rate limiting, lockout policies, and breach detection to mitigate online attacks. For legacy systems, migration to modern algorithms is advised, and users should be encouraged to use password managers to generate and store strong, unique passwords.

Beyond the mainstream algorithms, several niche aspects of password hashing are often overlooked. The concept of 'peppering'—adding a secret application-wide value to the hash—provides an extra layer of security if the database is compromised but the application server is not. The 'honeyword' technique involves storing fake hashes to detect data breaches. In the realm of cryptography, the 'hash-based message authentication code' (HMAC) is sometimes used for password hashing, though it is not recommended due to its speed. Historically, the 'crypt' function in Unix used a variant of DES that was deliberately weakened to be slow, but it was still breakable. Additionally, the 'password hashing competition' also produced finalists like 'yescrypt' and 'POMELO', which are used in some systems. Finally, the concept of 'key stretching' is integral to password hashing, as it increases the computational cost per guess, and is also used in key derivation functions like HKDF.

Salt

A random value added to a password before hashing to ensure that identical passwords produce different hashes.

Pepper

A secret application-wide value added to a password hash to provide an extra layer of security.

Key stretching

The process of increasing the computational cost of hashing to slow down brute-force attacks.

Rainbow table

A precomputed table of hashes for common passwords, used to reverse hashes quickly.