5

The RFC does not specify, but I think if these values were available, they may help the attacker.

For example, for scrypt, if the block size parameter r, the CPU/Memory cost parameter N, and the parallelization parameter p values are available, the attack will know which values to use when bruteforcing.

Any idea?

  • 1
    The algorithm is open, and so are the parameters. Background: This has been a long topic of discussion (all the way back to ancient Rome) though, but since a few decades we know openness brings more security. We trust on the implementation, not on the likeliness some one might guess the details. As Anders said, parameters are implementation details. – Yorick de Wid Sep 2 '16 at 12:53
5

I would say that the cost parameters counts as "implementation details" and relying on them beeing hidden would therefore be security through obscurity.

Actively keeping them secret would be like using them as some kind of low entropy pepper. Not entierly useless, but almost. Plus, if an attacker manage to crack one password she will know the correct factors. So just try password1 with some different factors on all passwords, and you are done. If you want an additional secret to protect the passwords, just use an ordinary pepper or encrypt the hashes. Those are solutions actually intended to solve this problem.

That does not mean that you need to disclose them to all the world unless you have reason to. Sure, if you want to tell someone to brag about how secure your system is, go right ahead. But I would not put it on my webpage, especially if they were low since that could encourage attackers. (On the other hand, saying "we use bcrypt" is sort of like putting up an "beware of the dog" sign on your fence.)

Most people use one of a few sets of cost factors. I would encourage you to pick cost factors based on what is good for your system, and not what is hard to guess.

Do note that the cost factor is right there in the hash, so you would need to actively cut it from the string to implement this. But I would not bother.

Somewhat related question: Can I share what password hash function I used in a public report?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.