This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org
Difference between revisions of "Password Storage Cheat Sheet"
m (→Password Storage Rules) |
m |
||
| Line 3: | Line 3: | ||
= Introduction = | = Introduction = | ||
| − | This article is focused on providing guidance to storing a | + | This article is focused on providing guidance to storing a password in order to help prevent password theft. Too often passwords are stored as clear text. Thus the password can be read directly by the database’s administrator, super users or via data theft by SQL Injection. Database backup media is also vulnerable to password theft via password storage. It is recommended that you avoid storing the clear text password or an encrypted version of the password. |
== Password Storage Rules == | == Password Storage Rules == | ||
| − | It is crucial that passwords are stored in a way that they can be *verified* but not * | + | Passwords are secrets. There is no reason to decrypt them under any circumstances. It is crucial that passwords are stored in a way that they can be *verified* but not *reversed* in any way, even by insiders. To accomplish this, store the salted hashed value of the password. Preferably use a different random salt for each password hash instead of a constant long salt. |
# Use a modern hash | # Use a modern hash | ||
Revision as of 01:00, 25 November 2011
DRAFT CHEAT SHEET - WORK IN PROGRESS
Introduction
This article is focused on providing guidance to storing a password in order to help prevent password theft. Too often passwords are stored as clear text. Thus the password can be read directly by the database’s administrator, super users or via data theft by SQL Injection. Database backup media is also vulnerable to password theft via password storage. It is recommended that you avoid storing the clear text password or an encrypted version of the password.
Password Storage Rules
Passwords are secrets. There is no reason to decrypt them under any circumstances. It is crucial that passwords are stored in a way that they can be *verified* but not *reversed* in any way, even by insiders. To accomplish this, store the salted hashed value of the password. Preferably use a different random salt for each password hash instead of a constant long salt.
- Use a modern hash
- SHA
- bcrypt
- Use a long cryptographically random salt
- Isolate the salt from the hash
- Iterate the hash
References
Cryptographic framework for password hashing is described in PKCS #5 v2.1: Password-Based Cryptography Standard. Specific secure password hashing algorithms exist such as bcrypt, scrypt. Implementations of secure password hashing exist for PHP (phpass), ASP.NET (ASP.NET 2.0 Security Practices), Java (OWASP Hashing Java).
OWASP Cheat Sheets Project Homepage
