I am trying to achieve better security in my authentication system implementation with both server-side hashing and client-side hashing. (See the first reference below for more prerequisite knowledge.)
As I understand it:
- Client-side hashing prevents hackers from getting a user's plaintext password and using it for other sites when the server app is compromised. Compared to server-side KDF hashing, it can also help lighten the server load.
- Server-side hashing prevents hackers from logging in as users when the server database is compromised.
- KDFs such as Argon2 make it expensive for hackers to brute-force a list/dictionary of common or possible plaintext passwords against a hashed password.
I'd like the save some server computing resources. So here comes my question: is it safe to directly hash "a password already hashed with Argon2 on the client-side" on the server-side with SHA-256? Here I mean "safe" by being at least as safe as using server-side only Argon2. Besides, The second reference below also suggests hashing the authentication token (the so-called "validator" in their article) with SHA-256. Is doing this safe?
My answer: an Argon2-hashed password or an authentication token with a length of at least 16 bytes should be safe. The reasons are:
- There is no list/dictionary to try since the data is a byte string that can be anything.
- A full rainbow table of all 16-byte-long keys should contain 2 ^ 128 entries, which takes at least 2 ^ 128 * 32 B = 2 ^ 133 B ≈ 8 * 10 ^ 39 B = 8 * 10 ^ 27 TB of storage, which is way too big.
- Even if we take the peak Bitcoin hash rate till now 170000 Phash/s, it will still take 10 ^ 12 years to enumerate all the possibilities.
However, I am no security expert so I am not sure whether there are any other flaws. So it would be nice if someone professional could share his/her opinion on this.
PS: Here are the related articles and questions I have read and think are useful, and got me into this question.
- authentication - Why is client-side hashing of a password so uncommon? - Information Security Stack Exchange
- Implementing Secure User Authentication in PHP Applications with Long-Term Persistence (Login with "Remember Me" Cookies) - Paragon Initiative Enterprises Blog
- Password Storage - OWASP Cheat Sheet Series