This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org
Difference between revisions of "Password Storage Cheat Sheet"
From OWASP
m |
m (→Password Storage Rules) |
||
| Line 7: | Line 7: | ||
== Password Storage Rules == | == Password Storage Rules == | ||
| − | # Use a | + | # Use a Modern Hash |
## SHA | ## SHA | ||
## bcrypt | ## bcrypt | ||
| − | # salt | + | # Use a long cryptograpgically random salt |
| − | # salt | + | ## Isolate the salt from the hash |
| − | # hash | + | # Iterate the hash |
| − | |||
{{Cheatsheet_Navigation}} | {{Cheatsheet_Navigation}} | ||
| − | |||
[[Category:Cheatsheets]] | [[Category:Cheatsheets]] | ||
Revision as of 19:03, 21 September 2011
ACTIVE WORK IN PROGRESS AUGUST 2011
Introduction
This article is focused on providing guidance to storing a passwords in order to help prevent password theft.
Password Storage Rules
- Use a Modern Hash
- SHA
- bcrypt
- Use a long cryptograpgically random salt
- Isolate the salt from the hash
- Iterate the hash
OWASP Cheat Sheets Project Homepage
