I want to use a strong authentication scheme, so I decided to use PBKDF2. I'm using PBKDF2 with SHA256 algorithm, 5000 iterations and I use username (which is full email address of user) as salt. So every user have a unique email, their email address is their identifier. So when they enter password, I'll use PBKDF2 with 5000 iteration and SHA256 algorithm to hash user's password.

Do you think it's good? Can you tell me if there is any security weakness on this hashing scheme?


Yes, there's a weakness. You should change the salt every time the user changes the password, and you cannot do that with your scheme. An attacker who knows what the salt must be can mount a pre-computation attack, computing hashes for thousands of passwords. Then, even if a user changes the password, the attacker probably already has it pre-computed.

The salt should come from a cryptographically secure pseudo-random number generator (CSPRNG).

| improve this answer | |
  • Thank you for being clear, I understood. Can you point out some good CSPRNG algorithms? – JustACPPFan Jan 11 '15 at 0:17
  • It depends on the language. Try Google for something like "CSPRNG PHP" or "CSPRNG Java". – Bob Brown Jan 11 '15 at 0:18
  • 1
    Thank you, I'll accept answer after 10 min limit (it doesn't allow me to accept before that) – JustACPPFan Jan 11 '15 at 0:19
  • 1
    /dev/urandom on Linux/OSX, CryptGenRandom() on Windows. – Stephen Touset Jan 11 '15 at 0:34
  • 1
    Absolutely do not attempt to cobble together a zero-knowledge password protocol by yourself. If you must, use something like SRP, and use a preexisting implementation; it is, as I understand it, notoriously difficult to implement without unintentionally leaking information (for instance, through timing attacks). – Stephen Touset Jan 12 '15 at 19:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.