Pro PHP and jQuery by Jason Lengstorf.pdf - Computer Science ...

208
CHAPTER 6 ■ PASSWORD PROTECTION SENSITIVE ACTIONS AND AREAS
Improving Security with Salted Hashes
While not bulletproof, adding a salt to your hashing algorithm will make cracking your users' passwords
much more cumbersome for attackers. A salt is a string, either predefined or random, that is used in
addition to the user input when hashing.
Without using a salt, a password may be hashed like this:
$hash = sha1($password);
To add a random salt to the preceding hash, you could apply the following this code to it:
$salt = substr(md5(time()), 0, 7); // create a random salt
$hash = $salt . sha1($salt . $password);
The preceding code generates a random seven-digit salt. The salt is prepended to the password string
before hashing; this means that even if two users have the same password, their individual password
hashes will be different.
However, in order to reproduce that hash, the salt needs to be available. For this reason, the salt is also
prepended, unencrypted, to the hash. This way, when a user signs in, you’re able to extract the salt from
the hash when it’s retrieved from the database and use it to recreate the salted hash of the user’s
password:
$salt = substr($dbhash, 0, 7); // extract salt from stored hash
$hash = $salt . sha1($salt . $_POST['password']);
if ( $dbhash==$hash )
{
echo "Match!";
}
else
{
echo "No match.";
}
Incorporating Salted Hashes and Rainbow Tables
By adding a salt, rainbow tables are rendered useless. A new table will need to be generated taking the
salt into account in order to crack user passwords; while this isn’t impossible, it’s time-consuming for the
attacker and adds an extra layer of security to your app.
In most applications (especially those that don’t store much in the way of sensitive personal information
such as credit card information), a salted password is deterrent enough to ward off potential attackers.
As an additional countermeasure, it is also advisable to add a check for repeated failed attempts to log in.
This way, an attacker has a finite number of attempts to crack a password before being locked out of the
system. This can also prevent denial of service attacks, or attacks in which a huge volume of requests
are sent in an attempt to overload a site and take it offline.