Useful password hashing: How to waste computing cycles with style
Posted on 19 December 2013.
Password-based authentication is widely used today, despite problems with security and usability. To control the negative effects of some of these problems, best practice mandates that servers do not store passwords in clear, but password hashes are used.

Password hashes slow down the password verification and thus the rate of password guessing in the event of a server compromise. A slower password hash is more secure, as the attacker needs more resources to test password guesses, but at the same time it slows down password verification for the legitimate server. This puts a practical limit on the hardness of the password hash and thus the security of password storage.

We propose a conceptually new method to construct password hashes called "useful" password hashes (UPHs), that do not simply waste computing cycles as other constructions do (e.g., iterating MD5 for several thousand times), but use those cycles to solve other computational problems at the same time, while still being a secure
password hash. This way, we are convinced that server operators are willing to use slower password hashes, thus increasing the overall security of password-based authentication.

We give three constructions, based on problems from the field of cryptography: brute-forcing block ciphers, solving discrete logarithms, and factoring integers. These constructions demonstrate that UPHs can be constructed from problems of practical interest, and we are convinced that these constructions can be adapted to a variety of other problems as well.

Author: Markus Duermuth.

Conference: PasswordsCon Bergen 2013.


Harnessing artificial intelligence to build an army of virtual analysts

PatternEx, a startup that gathered a team of AI researcher from MIT CSAIL as well as security and distributed systems experts, is poised to shake up things in the user and entity behavior analytics market.

Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.

Daily digest

Receive a daily digest of the latest security news.

Thu, Feb 4th