-By Ian Harvey, Software Design Authority, Thales eSecurity
Storing passwords is more complex than it might sound. For organisations, protecting passwords, sensitive information and confidential data is of paramount importance, as is making sure the right protective measures are in place.
Regardless of whether a system is free of bugs, there’s nothing stopping a disgruntled systems administrator from snooping around a file, whether for their own satisfaction or for financial gain.
Harbouring users’ passwords in a plain text file or database simply will not do - the risks are just too great. Redoubling defence efforts is critical.
Making a hash of it
Four decades ago, Unix computer systems started to ‘hash’ passwords instead of keeping them in plain text format. A hash function was deployed to determine a value (in numerical form) for each password or phrase in such a way that, although a calculation itself may be easy, performing this ‘in reverse’ – to figure out the original password – is hard.
Confused? Let’s run through it step-by-step with a simple example.
Suppose we take a word in the English language, assigning each letter a value – i.e. A=one, B=two, C=three etc. Take each adjacent pair of letters in the word, multiply them together, and add them up. The “hash” of the word is this total.
So, based on this method, BEAD, for example, has a hash value of (BxE) + (ExA) + (AxD) = (2x5) + (5x1) + (1x4) = 19. The result of this calculation is then stored in the password file, rather than the original password itself.
If the file entry for my password possesses the number 2000, for example, then upon logging in and entering my password, the computer would perform the calculation above, and if the answer was 2000, it would allow me to enter. The wrong number, however, would deny me access.
As 2000 is the only value that is stored in the password file, as opposed to my actual password, this means that if a hacker were to steal the entire contents of the file, they would still need to solve a puzzle before they could log in pretending to be me.
But words will never hurt me…actually yes, they will
Hashed passwords alone won’t solve the problem, however. Despite being more secure than plaintext, problems still exist.
The goal of a dictionary attack is to obtain a list of all words in the English language, calculate their hash values individually, and match them against entries in the password file. Despite the volume of work involved, this will pay dividends, as it will in fact crack every password, not just one particular user’s.
During such an attack, an index is created that is organised by hash value, with individual words added to the index based on the calculations above: BAP goes on page 18, for example, BUN goes on 336, and so on. My password would then be found by ‘reversing’ the hash function: if my password hash was 2000, for example, my password could be found by simply turning to page 2000.
The cryptanalysts at Bletchley Park in World War II did just that. They worked out every possible way in which the common German word ‘eins’ could be enciphered with the Enigma machine, and recorded the Enigma settings as they went. The results were then sorted alphabetically into what became known as the ‘eins catalogue’. If the codebreakers were able to guess which encrypted letters represented the plaintext ‘eins’, they could then simply rummage through a battered green filing cabinet and pull out the key.
Rubbing salt in the wounds
Dictionary attacks can be defeated by what’s referred to as salt.
A random variation of the hash calculation is applied differently for each user’s password in what’s known as a salted hash scheme. One user could have A=17, B=5, C=13 and so on, while another could have A=4, B=22, C=17.
The password file would then store this salt (i.e. the A, B, C values), as well as the hash result. The computer would still perform a quick calculation to check the password, but the variation means that the same password would have different hash values for different users. This means it would be impossible to compile a single dictionary that could successfully reverse the hash for everyone.
Lastly, the very best modern systems use so-called iterated hash. This is designed to make the hash function itself harder to calculate by re-hashing the data thousands of times over. If the computer can slow down the process of checking passwords; anyone trying to search for the password will also be slowed down as a consequence.
Protecting passwords is by no means an easy task, but it is of fundamental importance for the basic cyber security foundations of any organisation. Taking the necessary, but vital, steps to shield passwords to such a degree that criminals, no matter how smart, cannot decipher them should be the cornerstone of any organisation’s digital defences.