CRV2 HashingandSaltingdotNet - Revision history

Larry Conklin at 02:45, 12 June 2013

2013-06-12T02:45:46Z

Larry Conklin at 02:43, 12 June 2013

2013-06-12T02:43:41Z

Larry Conklin at 02:40, 12 June 2013

2013-06-12T02:40:30Z

Larry Conklin at 02:26, 12 June 2013

2013-06-12T02:26:01Z

Larry Conklin at 02:24, 12 June 2013

2013-06-12T02:24:14Z

Larry Conklin at 01:55, 12 June 2013

2013-06-12T01:55:09Z

Larry Conklin at 01:54, 12 June 2013

2013-06-12T01:54:32Z

Larry Conklin at 03:21, 11 June 2013

2013-06-11T03:21:30Z

Larry Conklin at 03:20, 11 June 2013

2013-06-11T03:20:51Z

Larry Conklin at 02:59, 11 June 2013

2013-06-11T02:59:42Z

@@ Line 49: / Line 49: @@
              return dataWithSaltBytes;
+         }
       private string computeHashWithSalt(HashAlgorithm myHash, string input) {

@@ Line 27: / Line 27: @@
 ==Salt==
 One way to generate a secure salt value is using a pseudo-random number generator. Note that a salt value does not need to possess the quality of a cryptographically secure randomness.
-Best practices is to use a cryptographically function to create the salt, salt value should be created for each hash value, and a minimum value of 128 bits. The bits are not costly in most applications/platforms using a value of 256-bit salt value is highly recommended.
+Best practices is to use a cryptographically function to create the salt, salt value should be created for each hash value, and a minimum value of 128 bits. The bits are not costly so don't save a few bits thinking you gain something back in performance instead use a value of 256-bit salt value. It is highly recommended.
 ===.Net Salt===
      private int minSaltSize = 8;

@@ Line 58: / Line 58: @@
              return sb.ToString();
+         }
 * ''Java – java.security.SecureRandom
 * ''PHP - ???
 * ''Ruby - ???

@@ Line 47: / Line 47: @@
                  dataWithSaltBytes[data.Length + i] = saltBytes[i];
              return dataWithSaltBytes;
+         }

@@ Line 27: / Line 27: @@
 ==Salt==
 One way to generate a secure salt value is using a pseudo-random number generator. Note that a salt value does not need to possess the quality of a cryptographically secure randomness.
 * ''Java – java.security.SecureRandom

@@ Line 78: / Line 78: @@
 * ''http://docs.oracle.com/javase/6/docs/api/java/security/SecureRandom.html
 * ''http://msdn.microsoft.com/en-us/library/system.security.cryptography.rngcryptoserviceprovider.aspx
-* "http://csrc.nist.gov/publications/fips/fips180-4/fips-180-4.pdf
+* ''http://csrc.nist.gov/publications/fips/fips180-4/fips-180-4.pdf
-* "Ferguson and Schneier (2003) Practical Cryptography (see Chapter 6; section 6.2 Real Hash Functions)
+* ''Ferguson and Schneier (2003) Practical Cryptography (see Chapter 6; section 6.2 Real Hash Functions)

@@ Line 1: / Line 1: @@
 =Introduction=
-Cryptographic hashing functions are used to create digital signatures, message authentication codes (MACs) and other forms of authentication. They are also used to store user passwords in databases instead of storing the password in clear text and help prevent data leakage in session management for web applications. The actual algorithm used to create a cryptology function varies per implementation (MD5, SHA-512, etc.) but the main function is to take arbitrary block of data and return a fixed-size bit string.
+A cryptographic hash algorithm; also called a hash "function" is a computer algorithm designed to provide a random mapping from an arbitrary block of data (string of binary data) and return a fixed-size bit string known as a “message digest” and achieve certain security.
 The code reviewer needs to be aware of three main things when reviewing code that uses cryptographic hashing functions.
@@ Line 73: / Line 75: @@
 =References:=
-* '' http://valerieaurora.org/hash.html  (Lifetimes of cryptographic hash functions)
+* ''http://valerieaurora.org/hash.html  (Lifetimes of cryptographic hash functions)
-* '' http://docs.oracle.com/javase/6/docs/api/java/security/SecureRandom.html
+* ''http://docs.oracle.com/javase/6/docs/api/java/security/SecureRandom.html
-* '' http://msdn.microsoft.com/en-us/library/system.security.cryptography.rngcryptoserviceprovider.aspx
+* ''http://msdn.microsoft.com/en-us/library/system.security.cryptography.rngcryptoserviceprovider.aspx
-* " http://csrc.nist.gov/publications/fips/fips180-4/fips-180-4.pdf
+* "http://csrc.nist.gov/publications/fips/fips180-4/fips-180-4.pdf
-* " Ferguson and Schneier (2003) Practical Cryptography (see Chapter 6; section 6.2 Real Hash Functions)
+* "Ferguson and Schneier (2003) Practical Cryptography (see Chapter 6; section 6.2 Real Hash Functions)

@@ Line 44: / Line 44: @@
 ==.Net Agile Code example for hashing==
-pp Code File:
+App Code File:
 <add key="HashMethod" value="SHA512"/>

← Older revision		Revision as of 03:20, 11 June 2013
Line 43:		Line 43:
	FIPS disapproves the following functions DES; MD51; RC4; Blowfish; Diffie-Hellman2; Diffie-Hellman3 (key agreement); EC Diffie-Hellman2 (key agreement); AES4 (non-compliant); Diffie-Hellman5 (key agreement); EC Diffie-Hellman4 (vendor affirmed); RSA4 (key agreement); RSA2 (key wrapping).		FIPS disapproves the following functions DES; MD51; RC4; Blowfish; Diffie-Hellman2; Diffie-Hellman3 (key agreement); EC Diffie-Hellman2 (key agreement); AES4 (non-compliant); Diffie-Hellman5 (key agreement); EC Diffie-Hellman4 (vendor affirmed); RSA4 (key agreement); RSA2 (key wrapping).

		+	==.Net Agile Code example for hashing==
		+	pp Code File:
		+	<add key="HashMethod" value="SHA512"/>

		+	C# Code:
		+	1: preferredHash = HashAlgorithm.Create((string)ConfigurationManager.AppSettings["HashMethod"]);
		+	2:
		+	3: hash = computeHash(preferredHash, testString);
		+	4:
		+	5: private string computeHash(HashAlgorithm myHash, string input) {
		+	6: byte[] data;
		+	7: data = myHash.ComputeHash(Encoding.UTF8.GetBytes(input));
		+	8: sb = new StringBuilder();
		+	9: for (int i = 0; i < data.Length; i++) {
		+	10: sb.Append(data[i].ToString("x2"));
		+	11: }
		+	12: return sb.ToString();
		+	13: }
		+
		+	Line 1 let's us get our hashing algorithm we are going to use from the config file. If we use the machine config file our implementation would be server wide instead of application specific.
		+	Line 3 allows us to use the config value and set it according as our choice of hashing function. ComputHash can be SHA-256 or SHA-512.
		+
		+	The drawback to this method is key size. I would suggest of giving yourself twice the size of the largest key of hashing algorithm you could possible use to store hash values. This means we need a varchar of 1024 if we are going to store our hash value in the database.
		+
		+	==Afterword==
	Lastly, never accept in a code review an algorithm created by the programmer for hashing or copy a hashing function taken from the Internet. Always use cryptographic functions that are provided by the language framework the code is written in. These functions are well vetted and well tested by experience cryptographers.		Lastly, never accept in a code review an algorithm created by the programmer for hashing or copy a hashing function taken from the Internet. Always use cryptographic functions that are provided by the language framework the code is written in. These functions are well vetted and well tested by experience cryptographers.

← Older revision		Revision as of 02:59, 11 June 2013
Line 53:		Line 53:
	* '' http://msdn.microsoft.com/en-us/library/system.security.cryptography.rngcryptoserviceprovider.aspx		* '' http://msdn.microsoft.com/en-us/library/system.security.cryptography.rngcryptoserviceprovider.aspx
	* " http://csrc.nist.gov/publications/fips/fips180-4/fips-180-4.pdf		* " http://csrc.nist.gov/publications/fips/fips180-4/fips-180-4.pdf
		+	* " Ferguson and Schneier (2003) Practical Cryptography (see Chapter 6; section 6.2 Real Hash Functions)