20

I started reading about password hashing recently on multiple sites like this page on crackstation and others, and for what I have understood, I should avoid using hashing algorithms like md5 and sha1 for they are outdated and instead, I should use sha256 with salt. But, after reading this page on the php manual, I noticed that they discourage the use of even sha256 and instead they recommend using the password_hash() functions. I also noticed that most of this articles/pages were written in the interval of 2011-13, so I am not sure of how secure sha256 hashed password with salts are nowadays and whether or not it should still be used in webapps.

marked as duplicate by schroeder, D.W., Gilles, Stephane, Mark May 26 '15 at 7:59

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

27

General-purpose hashes have been obsolete for passwords for over a decade. The issue is that they're fast, and passwords have low entropy, meaning brute-force is very easy with any general-purpose hash. You need to use a function which is deliberately slow, like PBKDF2, bcrypt, or scrypt. Crackstation actually explains this if you read the whole page. On the other hand, MD5 and SHA-1 aren't weaker than SHA-2 in the context of password hashing; their weakness is not relevant for passwords.

  • 2
    Does this answer not apply in the scenario where passwords actually have high entropy? – NH. Sep 29 '17 at 21:31
  • @NH. Passwords cannot have high entropy. They need to be remembered by humans. Even the infamous password of 'correct horse staple battery' is relatively easy to crack once you understand the RULES people use. The Shannon entropy is what matters when cracking passwords. – christopher clark Oct 17 '17 at 13:56
19

As @cpast says, the main problem of a single SHA-256 is that it is way too fast. An attacker with an off-the-shelf gaming GPU can try passwords at a rate that is counted in billions per second (American billions, but that's still a lot).

Another problem is that there is potential for combining things improperly. SHA-256 is a hash function: it takes one input, and produces an output. If you feed SHA-256 with a password and a salt, then you are really defining your own cryptographic protocols, based on SHA-256 with some extra things, the extra things telling how the password and the salt are combined to make the SHA-256 input. Designing cryptographic protocols is known to be hard, notably because there is no reliable test for security. You cannot know whether you did right. (Well, when your server has become hosts to a full party of hackers connecting from a dozen different countries you had never heard of, then you know that you did wrong, but it is a bit too late...)

Proper password hashing has a theory. Read this answer as a primer on the subject.

  • In every theory there is a practice. The so very much feared "extra things" is as simple as pwd = salt + pwd. That's all, no? – Pacerier Sep 10 '16 at 2:55
10

sha256 is not designed to hash passwords. To hash passwords, you should prefer to use hash functions created for this usage. You will find all required information below in another question addressing a similar request: Most secure password hash algorithm(s)?.

In the above mentioned question, you will learn why general purpose hash functions like sha256 do not have the right properties to ensure a secure storage of passwords (even when applied a large number of times on itself), and you will also find a ranking of the most-recommended hash functions dedicated for secure passwords handling:

  1. scrypt: Which is still quite new (published in 2012), but is designed to ensure better security than its predecessor bcrypt,
  2. bcrypt: It was designed specifically for password storage and was the recommended choice for a long time,
  3. PBKDF2: It's actually designed as a key stretching function, ie. a secure way to derive a cryptographic key from a given password, but its properties make it also suitable for password storage.

In your question you mentioned the PHP function password_hash(). This function is not a hash algorithm per se. In fact, this function is used to allow PHP to select the most trusted password hash algorithm available without having to modify your code.

As indicated in the documentation, as per PHP 5.5.0, bcrypt is selected by default.

  • 1
    One of the ways scrypt improves over the others is that not only does it make the hash computationally intensive in terms of CPU cycles, it also requires huge amounts of memory to perform each hash as well, which makes it harder to compute hashes massively in parallel (eg, using GPUs). Note: these algorithms are scalable in that when you perform the hash you specify how many "rounds" ie how computationally intensive the hash will be, so it's possible to make any of them faster but easier to compute, or harder to compute but slower. – thomasrutter May 26 '15 at 1:28

Not the answer you're looking for? Browse other questions tagged or ask your own question.