Coda Hale lives in Emeryville, CA, where he writes about programming, web development, and the occasional bit about bicycles.
31 Jan 2010
bcryptUse bcrypt. Use bcrypt. Use bcrypt. Use bcrypt. Use bcrypt. Use bcrypt. Use bcrypt. Use bcrypt. Use bcrypt.
MD5, SHA1, SHA256, SHA512, SHA-3, etc}?These are all general purpose hash functions, designed to calculate a digest of huge amounts of data in as short a time as possible. This means that they are fantastic for ensuring the integrity of data and utterly rubbish for storing passwords.
A modern server can calculate the MD5 hash of about 330MB every second. If your users have passwords which are lowercase, alphanumeric, and 6 characters long, you can try every single possible password of that size in around 40 seconds.
And that’s without investing anything.
If you’re willing to spend about 2,000 USD and a week or two picking up CUDA, you can put together your own little supercomputer cluster which will let you try around 700,000,000 passwords a second. And that rate you’ll be cracking those passwords at the rate of more than one per second.
It’s important to note that salts are useless for preventing dictionary attacks or brute force attacks. You can use huge salts or many salts or hand-harvested, shade-grown, organic Himalayan pink salt. It doesn’t affect how fast an attacker can try a candidate password, given the hash and the salt from your database.
Salt or no, if you’re using a general-purpose hash function designed for speed you’re well and truly effed.
bcrypt Solves These ProblemsHow? Basically, it’s slow as hell. It uses a variant of the Blowfish
encryption algorithm’s keying schedule, and introduces a work factor, which
allows you to determine how expensive the hash function will be. Because of
this, bcrypt can keep up with Moore’s law. As computers get faster you can
increase the work factor and the hash will get slower.
How much slower is bcrypt than, say, MD5? Depends on the work factor. Using
a work factor of 12, bcrypt hashes the password yaaa in about 0.3 seconds on
my laptop. MD5, on the other hand, takes less than a microsecond.
So we’re talking about 5 or so orders of magnitude. Instead of cracking a
password every 40 seconds, I'd be cracking them every 12 years or so. Your
passwords might not need that kind of security and you might need a faster
comparison algorithm, but bcrypt allows you to choose your balance of speed
and security. Use it.
Use bcrypt.
You'll notice there are no comments here. I hate discussing things via blog comments. If you'd like to talk, drop me a line. If you'd like to discuss things in public, post on your blog. This content is mine, but feel free to avail yourself of your fair use rights.