Understanding hashing and why passwords aren't encrypted

// What is hashing?

Hashing is a one-way function that takes an input and produces a fixed-size string of characters, which appears random. The primary goal of hashing is to ensure data integrity and to securely store sensitive information like passwords. A good hash function is deterministic, fast to compute, and produces unique outputs for different inputs.

For example, if you hash the word ‘password123’ using a SHA-256 hash function, you get:

$ echo -n "password123" | sha256sum

ef92b7799c3c4c9b6b8a1e4b0d5a6b2b9e2e9e1cb2ed9b7d3e2a885d1e0d9c2e

The output is always the same for the same input, making it deterministic. However, if even a single character in the input changes, the output changes drastically, which enhances security.

// What hashing is not

It's essential to clarify what hashing is not. Hashing is not encryption. Encryption is a reversible process where data can be transformed into a secure format and later decrypted back to its original form using a key. Hashing, on the other hand, is designed to be irreversible. Once data is hashed, you cannot retrieve the original input from the hash.

Example of hashing vs encryption

To illustrate the difference:

• Hashing: hash = hash_function(data)
• Encryption: ciphertext = encrypt_function(data, key)

In practice, this means that if you have a hashed password stored in a database, you cannot recover the original password from that hash. You can only compare the hash of a new password attempt to the stored hash.

// Why are passwords hashed?

When users create accounts and set passwords, those passwords need to be stored securely. Storing passwords in plaintext is a significant vulnerability. If a database is compromised, attackers can directly access user passwords. Instead, we hash passwords for several reasons:

1. Irreversibility: As mentioned earlier, hashing is one-way. Even if an attacker gains access to the password hash, they cannot retrieve the original password directly.

2. Fixed Size: Hashes have a fixed size regardless of input size, making storage predictable and efficient.

3. Collision Resistance: A good hash function minimizes the chances of two different inputs producing the same hash, referred to as a collision.

4. Performance: Hash functions can be computed quickly, which is crucial for user authentication processes.

// Common hashing algorithms

Some widely used hashing algorithms include:

• MD5: Fast but not collision-resistant, not recommended for security-sensitive applications.
• SHA-1: More secure than MD5 but has known vulnerabilities.
• SHA-256: Part of the SHA-2 family and widely regarded as secure.
• bcrypt: Specifically designed for hashing passwords, includes a work factor to slow down brute-force attacks.

For password storage, using bcrypt is a common practice. Here’s how you would hash a password using bcrypt on a Unix-like system:

$ sudo apt-get install bcrypt
$ echo "mysecretpassword" | bcrypt

// Password verification workflow

The process of verifying a password against a hash typically follows these steps:

1. User submits a password.

2. Hash the submitted password using the same hashing algorithm used during registration.

3. Compare the new hash with the stored hash.

4. If they match, authentication succeeds.

Here's a simple pseudocode representation:

function verifyPassword(storedHash, passwordAttempt):
    newHash = hashFunction(passwordAttempt)
    return newHash == storedHash

// Mistakes to avoid

When implementing password hashing, avoid the following mistakes:

• Using a weak hash function like MD5 or SHA-1.
• Not using a salt. A salt is a random value added to the password before hashing to ensure that identical passwords generate different hashes.
• Not using a work factor. This adjusts the complexity of the hashing algorithm, making brute-force attacks more difficult.

// Defensive implications

Hashing passwords significantly reduces the risk of exposure if a database is compromised. However, it is not foolproof. Here are some defensive practices:

• Always use a strong and secure hashing algorithm.
• Implement rate limiting on authentication attempts.
• Store salts and hashes securely.
• Monitor for unusual access patterns in your systems.

// Quick checklist for hashing passwords

• [ ] Choose a secure hashing algorithm (e.g., bcrypt, scrypt).
• [ ] Implement salting for each password hash.
• [ ] Use a work factor to slow down hashing.
• [ ] Regularly update your hashing strategy as needed.

By understanding the mechanics of hashing and why it's used for passwords, you can improve your security posture and better defend against common vulnerabilities.

--- // FIELDOPS REPORT AUTHORIZED BY: Rachel H. //