Page History

Programs that store a password as cleartext (unencrypted text data) risk exposure of the password in a variety of ways. Programs must prevent this information from being leaked. Although a program generally receives the password from the user programs generally receive passwords from users as cleartext, this should be the last time the password is in this form.

An acceptable technique to limit for limiting the exposure of passwords is the use of hash functions, which allow programs to indirectly compare an input password to the original without storing a cleartext or decryptable version of the password. This approach minimizes the exposure of the password without presenting any practical disadvantages.

Cryptographic Hash Functions

The value that produced by a hash function outputs is called the hash value . Another term for hash value is or message digest. Hash functions are computationally feasible functions whose inverses are computationally infeasible. In practice, a password can be encoded to a hash value, but decoding remains infeasible. The equality of the passwords can be tested through the equality of their hash values.

It is important that you You should always append a salt to the password you are hashing. A salt is a randomly generated piece of data that is stored along with the hash value. The use of a salt helps prevent brute-force attacks against the hash value, provided the salt is long enough. Each password should have its own salt associated with it. If a single salt were used for more than one password, two users would be able to see if whether their passwords are the same.

The choice of hash function and salt length presents a trade-off between security and performance. If it takes longer Increases in the time required to compute a hash value, then the performance of a brute-force attack is lowered. This come at the cost of slowing down the program when it validates passwords. If a longer salt length is used, then the performance of a brute-force attack is lowered at the cost of the extra storage space requiredvalues raise the effort required for effective brute-force attacks, but make the program slower when must it validate a password. Increasing the length of the salt makes brute-force attacks more difficult, but requires additional storage space.

Java's MessageDigest class provides the functionality implementations of various cryptographic hash functions. Be careful not to pick a defective function Avoid defective functions such as MD5. Hash functions such as SHA-1 and SHA-2 are maintained by the NSA and are currently considered safe.

...

This noncompliant code example encrypts and decrypts the password stored in credentials.pw..

public final class Password {
  private void setPassword(byte[] pass) throws Exception {
   bytes[] encrypted = encrypt(pass); //arbitrary encryption scheme
    clearArray(pass);    
    saveBytes(encrypted,"password.bin"); //encrypted password to password.bin
  }

  private boolean checkPassword(byte[] pass) throws Exception {
    boolean arrays_equal;
    byte[] encrypted = loadBytes("password.bin"); //load the encrypted password
    byte[] decrypted = decrypt(encrypted);
    arrays_equal = Arrays.equal(decrypted, pass);
    clearArray(decrypted);
    clearArray(pass);
    return arrays_equal;
  }

  private clearArray(byte[] a) {
    //set all of the elements in a to zero
  }
}

...

In both the setPassword() and checkPassword() methods, the cleartext representation of the password is erased immediately after is converted into a hash value. Consequently, an attacker cannot get the password as cleartext after the erasureattackers must work much harder to retrieve the cleartext password after the erasure. Providing truly guaranteed erasure is extremely challenging, likely to be platform-specific and may even be impossible due to the possible involvement of copying garbage collectors, dynamic paging, and other platform features that operate below the level of the Java Language. Note, however, that most other languages share these complications (with the possible exception of garbage collection).

Applicability

Passwords stored without a secure hash are exposed to malicious users. Violations of this guideline generally have a clear exploit associated with them.

Applications such as password managers may need to retrieve the original password in order to enter it into a third-party application. This is permitted, even though it violates the guidline. The password manager is accessed by a single user and always has the user's permission to store his passwords and to display those passwords on command. As a result, provided the user is competent, Consequently, the limit to safety and security is the user's competence rather than the program's operation will be safe.

Related Guidelines

...