How Password Hashing Algorithms Work and Why You Never Ever Write Your Own

Are you fascinated with cryptography? You're not alone: a lot of engineers are. Occasionally, some of them decide to go as far as to write their own custom cryptographic hash functions and use them in real-world applications. While understandably enticing, doing so breaks the number 1 rule of the security community:??ｯdon't write your own crypto.ﾂ?

How do hashing algorithms work and what's special about password hashing? What does it take for an algorithm to get ready for widespread production use? Is security through obscurity a good idea? Let's see.ﾂ?

How does password hashing work?ﾂ?

Before storing a user's password in your application's database, you're supposed to apply a cryptographic hash function to it. (You're not storing passwords in plain text, right? Good. Just asking.)ﾂ?

Any cryptographic hash function converts an arbitrary-length input (a.k.a. "message") into a fixed-length output (a.k.a. "hash", "message digest"). A??ｯsecure cryptographic hash function??ｯmust be:ﾂ?

• Deterministic: hashing the same input should always render the same output.ﾂ?


• One-way: generating an input message based on a given output should be infeasible.ﾂ?


• Collision-resistant: finding two input messages that hash to the same output should also be infeasible.ﾂ?


• Highly randomized: a small change in input should lead to a significant and uncorrelated change in output (a.k.a. "the avalanche effect"). Without this property, applying cryptoanalysis methods will allow making predictions about the input based on the output.ﾂ?

Now, there's general cryptographic hashing, and then there's password hashing that is somewhat special.ﾂ?

Standard cryptographic hash functions are designed to be fast, and when you're hashing passwords, it becomes a problem.??ｯPassword hashing must be slow.??ｯYou want to make it as hard as possible for the attacker to apply brute force attacks to passwords in your database should it ever leak. This is why you want to make passwords hashing computationally expensive. How expensive? Well, it's a tradeoff between convenience for your legitimate users when they validate their passwords and making brute-force attacks hard for the attacker.ﾂ?

To make hashing computationally expensive, a special kind of functions is commonly used:??ｯkey derivation functions??ｯ(KDFs). Under the hood, KDFs invoke hashing functions, but they add a random salt before hashing, and then apply numerous (usually thousands or tens of thousands) iterations of hashing. Ideally, they make brute force attacks both CPU-intensive and memory-intensive.ﾂ?

A key derivation function produces a derived key from a base key and other parameters. In a password-based key derivation function, the base key is a password and the other parameters are a salt value and an iteration countﾂ?(.ﾂ?