I want to store a password hash in plain sight. If I am using a dictionary to crack an Argon2 hashed password that I am storing in plain sight, how long would it take (assuming my password is reasonably complex)? Further, are there any other attack risks that I am not aware of by storing password hash in plain sight?
13
-
2What is the purpose to use password, if you authenticated user by public key?– mentallurgMar 24 at 23:13
-
The purpose of password is to free up user from having to carry around the private key/signing application (eg, wallet). For example, I want to go to the library and be able to login without needing to set up a wallet and input my secret key into that public computer (or derive it from a long cumbersome mnemonic phrase).– blairmunroakusaMar 27 at 20:16
-
Do you mean that you want users to enter theirs passwords on PCs that don't belong them? This would be a security disaster. It makes no sense to talk about hashing, Argon2 etc. if the attacker can easily use the same PC as the user. Here are just a few easy ways for the attacker to get access to your users' accounts.– mentallurgMar 27 at 21:23
-
1) In a library the attacker can easily see what password has user entered.– mentallurgMar 27 at 21:24
-
2) Many users don't really understand what cookies are. They will leave browser with valid cookies. The attacker will get direct access to the account without even knowing the password.– mentallurgMar 27 at 21:25
|
Show 8 more comments
1 Answer
If I am using a dictionary to crack an Argon2 hashed password that I am storing in plain sight, how long will it take? (--assuming my password is reasonably complex).
The success of brute-forcing depends mainly on following factors:
- Password entropy
- Parameters used for Argon2
- Attacker resources
Modern GPUs can compute more than 100 000 000 quick hashes (like SHA-256) per second. Parameters are usually chosen such that hashing takes long enough to slow the attacker down, but still fast enough to be acceptable for normal users. Let say you set parameters so that hashing of single password takes 1s. Thus you make brute-forcing 100 000 000 times slower compared to SHA-256.
Suppose passwords use randomly selected 64 characters. If password length is 10, then there are 6410 = 260 potential passwords. To try all of them the attacker will need 260 seconds, which means 235 years. If the attacker could afford 1 000 000 000 such powerful GPUs, then it would be needed 100 000 years.
Means, even if password is as short as 10 characters and is generated randomly, it can still be unbreakable.
But if passwords were not generated randomly, but were chosen from a dictionary of let say 10 000 often used words, then slightly modified, and the attacker creates 100 modifications for each dictionary word, then there would 1 000 000 password candidates to test. Which means 278 hours, or less than 12 days for a single GPU.
You can similarly calculate the brute-forcing time for other cases, e.g. if only 26 English letters are used, case insensitive. Or if password length is 15 or 20.
