Impactful data breaches that exposed the online accounts and financial information of billions of individuals have increased recently because of the digitization of numerous industries. As a result, the need for comprehensive cybersecurity measures has risen, particularly with regard to the safekeeping of user passwords. Strong password storage security ensures that even if an attacker has access to compromised data, they are unable to utilize the passwords in attack vectors like credential-stuffing assaults. Additionally, it will reduce the risk of threats like fraudulent account charges or account takeovers for users. This study compares the performance of several hashing algorithms, including Bcrypt, SHA-256 and MD5 and how bcrypt algorithm outperforms the other algorithms. Reversal of each of the results will be attempted using Rainbow Tables for better understanding of hash reversals and the comparisons are tabulated. The paper provides a detail implementation of bcrypt algorithm and sheds light on the methodology of BCRYPT hashing algorithm results in robust password security. While SHA-256 hashing algorithms are, easily susceptible to simple attacks such as brute force as it a fast algorithm and making bcrypt more favorable. 

Secure Hashing using BCrypt for Cryptographic Applications

Recently, there has been a rise in impactful data breaches releasing billions of people’s online accounts and financial data into the public domain. The result is an increased importance of effective cybersecurity measures, especially regarding the storage of user passwords. Strong password storage security means that an actor cannot use the passwords in vectors such as credential-stuffing attacks despite having access to breached data. It will also limit user exposure to threats such as unauthorized account charges or account takeovers. This research evaluates the effectiveness of different password storage techniques. The storage techniques to be tested are: BCRYPT Hashing, SHA-256 Hashing, SHA-256 with Salt, and SHA-256 with MD5 Chaining. Following the National Institute of Standards and Technology (NIST) guidelines on password strength, both a weak and robust password will be passed through the stated techniques. Reversal of each of the results will be attempted using Rainbow Tables and dictionary attacks. The study results show that pairing a strong password that has not been exposed in a data breach with the BCRYPT hashing algorithm results in the most robust password security. However, SHA-256 hashing with a salt results in a very similar level of security while maintaining better performance. While plain SHA-256 hashing or chaining multiple hashing algorithms together is theoretically as secure, in practice, they are easily susceptible to simple attacks and thus should not be used in a production environment. Requiring strong password which have not been exposed in previous data breaches was also found to greatly increase security.

Rohan Patra

Papers

Cryptography: A Quantitative Analysis of the Effectiveness of Various Password Storage Techniques