An Evaluation of Secure Storage of Authentication Data

Abstract

The issue of secure password storage is of major industry concern, as all databases are at risk of breach, potentially leaving all associated user accounts vulnerable. Key industry documents such as 'IEEE Standard Specifications for Password-Based Public-Key Cryptographic Techniques' and 'RFC 2898: Password-Based Cryptography Specification' outline best practice mechanisms for secure storage of authentication credentials. We examine here authentication and secure storage of authentication data, inclusive of common industry implementation and best practice standards and regulation. The broader topic of authentication is examined to assess 'state-of-the-art' technologies that are currently available. The technologies researched included biometrics, multifactor authentication and smart cards and we show that despite the advancements these technologies have contributed to the area of authentication, it is unrealistic to expect their common implementation soon.