-1

I use sha1() to hash my users passwords, but recently a friend told me that if someone get the hash then they could use dictionary attack and he recommended using salts.

I implemented a random salt for each user and asked the users to reset their passwords. Is the passwords now protected against dictionary attack?

John The Ripper
  • 129
  • 1
  • 10
  • 5
    Read [Thomas Pornin's answer](http://security.stackexchange.com/questions/211/how-to-securely-hash-passwords/31846#31846). Yes, I know how long it is. The important point for you is that you need salt **and slowness*, a salted SHA-1 isn't slow. Don't roll your own: use your programming framework's PKBDF2 or bcrypt or scrypt. – Gilles 'SO- stop being evil' Jun 18 '13 at 19:31

1 Answers1

4

I believe there are some misconceptions that needs to be corrected. First of all, a dictionary attack is a brute-force attack, but with a special assumption. In the case of hashed passwords, it assumes that the password is a word of the dictionary (or some mutation of it) and then goes over each and every word in the dictionary, hashes it and then compares it to the stolen hash to find a match.

When your friend said "dictionary attack" he probably meant rainbow tables, and a proper salt does indeed protect against rainbow tables (pre-computing a gigantic list of hashes for quick comparison right after stealing the hashes), but it almost has nothing to do with dictionary attacks. Proper salting has other benefits as well, such as preventing the attack from cracking two passwords at the same time.

Having that said, I'm also concerned about how fast your current hashing scheme is. I highly recommend learning how to securely hash passwords by using slow schemes that are especially designed for this purpose, such as BCrypt or PBKDF2.

Community
  • 1
Adi
  • 43,808
  • 16
  • 135
  • 167
  • so there is no protection against dictionary attacks? – John The Ripper Jun 18 '13 at 19:42
  • @JohnTheRipper I don't think I can be any clearer, sorry. – Adi Jun 18 '13 at 19:46
  • 2
    @JohnTheRipper, slow hashing like Gilles said, locking accounts after too many failed attempts, limiting attempts by IP, asking users to include an uncommon character in their password, etc. There are plenty of ways to prevent or at least slow down dictionary attacks. Take some time to read the link provided by Gilles. – Simon Jun 18 '13 at 19:55