What is the recommended way to encrypt user passwords in a database?

Question

In a web application written in Perl and using PostgreSQL the users have username and password. What would be the recommended way to store the passwords?

Encrypting them using the crypt() function of Perl and a random salt? That would limit the useful length of passswords to 8 characters and will require fetching the stored password in order to compare to the one given by the user when authenticating (to fetch the salt that was attached to it).

Is there a built-in way in PostgreSQL to do this?

Should I use Digest::MD5?

Answer 1

Use SHA1 or SHA256 hashing with salting. Thats the way to go for storing passwords.

Answer 2

I would suggest storing it as a salted md5 hash.

INSERT INTO user (password) VALUES (md5('some_salt'||'the_password'));

You could calculate the md5 hash in perl if you wish, it doesn't make much difference unless you are micro-optimizing.

You could also use sha1 as an alternative, but I'm unsure if Postgres has a native implementation of this.

I usually discourage the use of a dynamic random salt, as it is yet another field that must be stored in the database. Plus, if your tables were ever compromised, the salt becomes useless.

I always go with a one-time randomly generated salt and store this in the application source, or a config file.

Another benefit of using a md5 or sha1 hash for the password is you can define the password column as a fixed width CHAR(32) or CHAR(40) for md5 and sha1 respectively.

Answer 3

If you don't use a password recovery mechanism (Not password reset) I think using a hashing mechanism is better than trying to encrypt the password. You can just check the hashes without any security risk. Even you don't know the password of the user.

Answer 4

Using MD5 would be one of the easiest ways to accomplish your goal.

Answer 5

The pgcrypto module in PostgreSQL has builtin suppotr for password hashing, that is pretty smart about storage, generation, multi-algorithm etc. See http://www.postgresql.org/docs/current/static/pgcrypto.html, the section on Password Hashing Functions. You can also see the pgcrypto section of http://www.hagander.net/talks/hidden%20gems%20of%20postgresql.pdf.

Answer 6

MD5 is commonly used, but SHA1/SHA256 is better. Still not the best, but better.

The problem with all of these general-purpose hashing algorithms is that they're optimized to be fast. When you're hashing your passwords for storage, though, fast is just what you don't want - if you can hash the password in a microsecond, then that means an attacker can try a million passwords every second if they get their hands on your password database.

But you want to slow an attacker down as much as possible, don't you? Wouldn't it be better to use an algorithm which takes a tenth of a second to hash the password instead? A tenth of a second is still fast enough that users won't generally notice, but an attacker who has a copy of your database will only be able to make 10 attempts per second - it will take them 100,000 times longer to find a working set of login credentials. Every hour that it would take them at a microsecond per attempt becomes 11 years at a tenth of a second per attempt.

So, how do you accomplish this? Some folks fake it by running several rounds of MD5/SHA digesting, but the bcrypt algorithm is designed specifically to address this issue. I don't fully understand the math behind it, but I'm told that it's based on the creation of Blowfish frames, which is inherently slow (unlike MD5 operations which can be heavily streamlined on properly-configured hardware), and it has a tunable "cost" parameter so that, as Moore's Law advances, all you need to do is adjust that "cost" to keep your password hashing just as slow in ten years as it is today.

Answer 7

Don't use SHA1 or SHA256, as most other people are suggesting. Definitely don't use MD5.

SHA1/256 and MD5 are both designed to create checksums of files and strings (and other datatypes, if necessary). Because of this, they're designed to be as fast as possible, so that the checksum is quick to generate.

This fast speed makes it much easier to bruteforce passwords, as a well-written program easily can generate thousands of hashes every second.

Instead, use a slow algorithm that is specifically designed for passwords. They're designed to take a little bit longer to generate, with the upside being that bruteforce attacks become much harder. Because of this, the passwords will be much more secure.

You won't experience any significant performance disadvantages if you're only looking at encrypting individual passwords one at a time, which is the normal implementation of storing and checking passwords. It's only in bulk where the real difference is.

I personally like bcrypt. There should be a Perl version of it available, as a quick Google search yielded several possible matches.