Password-Hashing Status

Abstract

Computers are used in our everyday activities, with high volumes of users accessing provided services. One-factor authentication consisting of a username and a password is the common choice to authenticate users in the web. However, the poor password management practices are exploited by attackers that disclose the users' credentials, harming both users and vendors. In most of these occasions the user data were stored in clear or were just processed by a cryptographic hash function. Password-hashing techniques are applied to fortify this user-related information. The standardized primitive is currently the PBKDF2 while other widely-used schemes include Bcrypt and Scrypt. The evolution of parallel computing enables several attacks in password-hash cracking. The international cryptographic community conducted the Password Hashing Competition (PHC) to identify new efficient and more secure password-hashing schemes, suitable for widespread adoption. PHC advanced our knowledge of password-hashing. Further analysis efforts revealed security weaknesses and novel schemes were designed afterwards. This paper provides a review of password-hashing schemes until the first quarter of 2017 and a relevant performance evaluation analysis on a common setting in terms of code size, memory consumption, and execution time.

All the Numbers are US: Large-scale Abuse of Contact Discovery in Mobile Messengers

“…It is also possible to easily share and use precomputed rainbow tables, which is done for conventional rainbow tables as well [67], despite their significantly larger size. For other hash functions than SHA-1, we expect reversal and generation times to vary by a constant factor, depending on the computation time of the hash function [31] (except for hash databases where look-up times remain constant).…”

“…Another alternative is to increase the calculation time of each hash, either by performing multiple rounds of the hash function or by using hash functions like bcrypt [66] or Argon2 [6], which are specifically designed to resist brute-force attacks. Existing benchmarks show that with bcrypt only 2.9 kHashes/s and with Argon2 only 2.6 Hashes/s can be computed on a GPU compared to 794.6 MHashes/s with SHA-1 [31].…”

“…Today's best known protocols [37] also provide efficient implementations with reasonable runtimes on modern smartphones. Unfortunately, their limitation is the amount of data that needs to be transferred to the client in order to obtain an encrypted representation of the server's database: for 2 28 registered users (the estimated number of active users on Telegram [15]) it is necessary to transfer ≈1 GiB, for 2 31 registered users (a bit more than the estimated number of users on WhatsApp [15]) even ≈8 GiB are necessary. Moreover, even PSI protocols cannot prevent enumeration attacks, as discussed in § VI-A.…”

PSO Supported Ensemble Algorithm for Bad Data Detection Against Intelligent Hacking Algorithm

“…However, smart meters use digits as a password, and that can be cracked easily. And user information stealth or unwanted data packages can be sent to the network operator as a result of system failures, and blackouts can be seen (Hatzivasilis 2017). • Authentication-Identifying Attack: Although some power systems have truly complex communications protocols (Modbus/TCP or 3.0/TCP), the receive/transmit type packages might be cleartext.…”

Blockchain-based Electronic Patient Records for Regulated Circular Healthcare Jurisdictions

“…Further participants can include consumer rights organizations, privacy watchdogs and other Non Governmental Organisations (NGOs). With regards to achieving privacy, opting for a permissioned platform facilitates the mandatory use of a trusted execution environment hardware for the computing nodes such as Intel SGX [25] and the use of lightweight cryptography and password hashing to provide confidentiality of user credentials in clients [26], [27]. Finally, an additional benefit of using a permissioned blockchain would be that the authority retains a degree of control over source code and blockchain governance.…”