0

Windows 10 has its own way of encrypting hashes, but these can be brute-forced by hashcat. One of our students created 2 of his own password encryption algorithms in python (One for encode, one for decode). Is there a way we can implement his algorithms on our Windows 10 PC and Router such that the algorithm encodes the wifi password, creates a hash, and then sends it to the pc, which reads the hash and then uses the decode algorithm to get the correct password.

Edit: I read the possible duplicate, but what I'm trying to do here is implement this method of encryption along with standard hash encryption. This algorithm is for string encryption, which would encrypt the password before it becomes a hash. I agree that standard tried and true hash encryption is the safest hash encryption. How do I encrypt the string before it becomes a hash?

9
  • 1
    Possible duplicate of Is my developer's home-brew password security right or wrong, and why?
    – user163495
    Commented May 28, 2019 at 12:19
  • I'd imagine you'd need to modify the firmware on your router, but there could be hobbyist routers out there that support modifying their network stack. Commented May 28, 2019 at 12:29
  • Regarding your edit: Why do you want this? What do you believe is the gain from this?
    – user163495
    Commented May 28, 2019 at 12:36
  • @MechMK1 I must confess, it is supposed to be for educational reasons rather than full practicality. Commented May 28, 2019 at 12:43
  • If it is for educational purposes (which is perfectly fine), then what exactly are you trying to teach? How to patch Windows to accept custom crypto? Or that doing something to the password before it is being used by Windows would increase security?
    – user163495
    Commented May 28, 2019 at 12:51

1 Answer 1

1

Don't create your own custom algorithms. This is a trap that novices fall for again and again and again.

If you do, you will fail, because you are not an expert. Good algorithms are designed by people who spent decades on this very material, and the results again are checked by hundreds of cryptoanalysts, trying to find any imaginable flaw.

Your student, without trying to be personal, does not have this expertise. They are likely not even close. As a result, using your own "custom algorithm" will lead you to getting your connection cracked and highjacked, if anyone would seriously try.

How can we make our Wi-Fi secure?

Use a long passphrase! If brute force is your only worry, then use a long password that make brute force infeasible.

Use a password like .;{mr%chKzc<Z44aZ&+NV&uW!PuA5!CkJLA8*=c546/7'>,;{3@2w4x]9N}f?Da and you will be 100% safe.

6
  • Thanks for the response. I 100% agree that custom homebrew hash encryption is bad and unsafe. Our Student's encryption is a method of simple string encryption, which would encrypt the password before it becomes a hash using standard hash encryption. How do I use this string encryption first? Commented May 28, 2019 at 12:36
  • By encrypting the password first, the users will feel safe and tempted to use weaker passwords. Then the encryption key will leak (that's almost a certitude), and it will be a trivial matter to hack into your WiFi network.
    – A. Hersean
    Commented Jun 27, 2019 at 13:15
  • @A.Hersean Users will generally use weak passwords. The average user simply doesn't care.
    – user163495
    Commented Jun 27, 2019 at 14:05
  • @MechMK1 That's why password encryption (or hashing) is not the solution to the problem. A solution is to filter passwords that are too short or in a dictionary and to use a PBKDF like Argon2.
    – A. Hersean
    Commented Jun 27, 2019 at 14:19
  • @A.Hersean Yes, that's good advice, but not the topic of the question. I agree with your recommendation of using a strong PBKDF, but OP specifically asked about implementing their own, custom security scheme and the security benefits of doing so.
    – user163495
    Commented Jun 27, 2019 at 14:22

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .