Implementing-cryptography-using-python

68 Chapter 3 ■ Classical Cryptography
the password before it goes through the hashing process. You would then save
that random chunk of bits along with the hashed password. The reason salting
is effective is that if bad actors attack your hashing scheme, they are unable to
scale their attack to a large number of users or launch brute-force attacks across
the enterprise.
Salting means that a rainbow attack must be recomputed for each individual
user. That makes an attacker spend a lot more money per user, which is the
way I tend to analyze security. As a fun exercise, you can type hashed values
straight into the Google search engine. Try to get the plaintext for 161ebd7d-
45089b3446ee4e0d86dbcf92.
To examine salting in Python, type the following:
import hashlib
def saltPassword_sha512(password):
salt = b'cHp3'
hashed = hashlib.sha512(salt + password).hexdigest()
print ("%s:%s" % (salt, hashed)) # Store these
return hashed
plaintext_password = b'Password'
hashed_sha512 = saltPassword_sha512 (plaintext_password)
Stretching Passwords
Our next defense is the concept of key or password stretching. Stretching is a
technique used to make a weak key, passphrase, or password more secure against
brute-force attacks by increasing the time it takes to test each possible iteration.
Key stretching works by accepting input that is fed into an algorithm, and the
return result is an enhanced key. The enhanced key should be of a sufficient size
to make it impractical to break using brute-force techniques. The key-stretching
process may be repeated several times to consume a longer amount of processing
time. The idea is that if the user knows the correct key, the additional second or
two it takes to verify it doesn’t impact the user; however, if the system is under
attack, it should slow down the attacker significantly.
Password Tools
A number of Python libraries offer you ways to perform password functions
without having to develop your own; you will probably be better served by
using a library instead of rolling your own as it will keep your code simpler.
One of the most popular libraries is bcrypt. You can install bcrypt by using the
following statement:
pip3 install bcrypt