Cryptography: How it works | pt.1

This is the first article in the Cryptography series. Let’s teach the essentials of the technical part for the whole community to understand how it works.

3 min readJul 12, 2018

Attention: This is a more thorough explanation of security with Hash encryption.

Theory

Password hash is always a secondary defense. A server that authenticates needs some information in order to validate a password. A simple system literally stores the passwords themselves, and validation in this case is a simple comparison of strings. In this case, if someone peers at the database file, you’ll see too much information. This kind of breach happens in practice. A backup in the wrong place, an HD swapped and not erased properly, a SQL injection, and so on. See a detailed discussion on this blog.

Even though the content of a server that validates passwords necessarily includes the data for this validation, someone who has a mere copy of them can make a dictionary attack offline, trying out potential passwords until some match, and this type of attack is inevitable . This way we can try to make this attack as difficult as possible, and for this we have these tools:

Hash cryptographic functions: They are mathematical functions that while being efficient, no one knows how to reverse. The server can keep a hash of a password; when you make the comparison, just use the same hash in the second value and see if they match; anyway, looking at the hash you can not tell what the original password is.
Salts: One of the advantages of the attacker is the parallelism. The attacker takes a bunch of hashed-protected passwords and wants to find out as much as possible of them. It can simply make a hash of a potential password and compare that same hash with hundreds of different records. You can also use pre-calculated hash tables, including rainbow tables;
The characteristic of attacks with parallelism is to act on several passwords with the same hash function. Using salt is not about having a hash function, but a portion of it. Ideally each password should use its own hash function. A salt is a way of selecting a specific hash solution among a large family of functions. If properly used, it can completely end with parallelism.
Slowdown: Computers are getting faster, as Gordon Moore, the co-founder of Intel, theorized. Human brains do not. Each year attackers can test more and more passwords at the same time, while users do not remember more complex passwords (or refuse to remember). To do this, we can make hashes extremely slow using functions that require many iterations.

We have some very common cryptographic functions, like MD5 and the SHA family. Building a hash function using elementary operations is not an easy task. When cryptographers want to do this, they think deeply, and organize tournaments where roles “fight each other violently.” After hundreds of them turning, stirring, poking a function for several years and do not think anything bad about it, they begin to admit that perhaps that function might be considered more or less safe. That’s what happened in the SHA-3 competition. We have to use this way to build these functions because we do not know the best way. Mathematically we do not know if secure hash functions really exist, what we have are candidates (this is the difference between “can not be broken” and “no one knows how to break”).

A basic hash function, even safe as a hash function, is not appropriate for passwords, because of the following:

does not use salt, allowing parallel attacks (rainbow tables for MD5 and SHA-1 can be obtained for free, you do not even have the work to calculate);
are very fast and get more and more over time. With a reasonable market GPU, the hashing rate is billions of passwords per second.

So we need something better. What’s more, properly joining a hash, salt, and iterating function is no simpler than designing a hash function — at least if you want a safe result. Again, you rely on standard constructs that survived the continuous massacre of vengeful cryptographers.

Original text under license Creative Commons ShareAlike