2

I've been asked to implement a system to prevent reusing passwords on the same account.

The most secure way I know to do this is to compare hashes of the password + a known salt. bcrypt.hash(sha256(password), user.savedSalt))

The rest of the system uses a separate salted sha256 - bcrypt.hash(sha256(password), 10).

These two hashes each reveal different information about the original password.

Does having both make cracking the known salt hash easier?

2
  • I'm not quite sure I get what you're asking. Are you asking if knowledge of the digest created by H(password || salt) makes it possible to calculate H(password) more quickly?
    – forest
    May 3, 2018 at 23:35
  • 2
    You have some inconsistencies and misunderstandings in your question. The 10 in bcrypt.hash(password, 10) is not "rounds of salt generation", it is the cost parameter. Is it bcrypt or sha256? May 3, 2018 at 23:38

2 Answers 2

3

If you are storing the hashes of multiple passwords with the same salt, you are defeating the purpose of using a salt. The salt must be unique for each and every password, otherwise an attacker could compute H(password || salt) just once for each candidate password, and compare the resulting digest against every hash in your database, because they all use the same salt.

Also, as mentioned in the comments, you seem to be confusing the cost parameter for something else. The "10" specifies how much computation the bcrypt operation will take. A larger value increases the cost for attackers by making the operation more computationally expensive.

If you want to check for duplicate passwords, you don't need to come up with some homebrew scheme like this. If you really want, you can take the supplied password, concatenate it with the salt of the first user and hash it, and compare it against the stored hash. If it does not match, do the same for the second user, and so on. This does mean that each new password that is set will require walking through the entire database, but it will detect passwords that are exact duplicates.

0
-1

"Does having a salted password hash make cracking an unsalted hash of the same password easier?"

I found some places where people said this was theoretically true, but no one cited any work on it or anything in practice.

"The salt must be unique for each and every password..."

This is not true. We set a salt per user that remembered the users last few passwords. Salts are to defeat rainbow tables, and calculating a rainbow table per user for 3 passwords seem as inefficient as calculating tables for one password.

4
  • 2
    Just because you do that does not mean you are not violating best practice.
    – forest
    May 7, 2018 at 3:12
  • I'm also struggling to understand why anyone would think that it would be even theoretically true that having h' = f(m || salt) would make cracking h = f(m) any easier. Because of the length extension attack that applies to most modern hash functions, you can calculate the result of a hash with any suffix without needing to know the original message, only the hash of the message (and salts are usually appended). That is, given only h from h = f(m), you can easily calculate h' = f(m || n) for any arbitrary n, even if you do not know m.
    – forest
    May 7, 2018 at 3:16
  • 1
    Since hashes are public, if I see a salt and an unsalted hash, I can trivially find out what the hash would be if it were hashed with the salt (assuming Merkle–Damgård construction). Therefore it is impossible for knowledge of a salted hash to reveal any further information about the contents of the original message if you already have access to the unsalted hash.
    – forest
    May 7, 2018 at 3:18
  • Here is a real example: Let's take a real unsalted MD5 hash e762782eeba78f9b562f9a6041ffb03c. I have no idea what the original message was, but I still know that c9cefaafed7524fd449af83a619ab195 would be the hash if the original message was salted with the string "this is a salt".
    – forest
    May 7, 2018 at 3:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .