Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:61896
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.216.170 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <00b701cd6f35$b2d621a0$188264e0$@com>
References: <CAAyV7nFRT24rksh6iDWxstfQwJ4+KdEC7Zs6EC8wBtJ8Zorf7w@mail.gmail.com>
	<4FFF1831.8070902@sugarcrm.com>
	<CAAyV7nHi0k6S-zbi5=xCE8EmXpaEds9RoZTB8RPOeO8K_ZLY=w@mail.gmail.com>
	<005101cd6f18$9da38510$d8ea8f30$@com>
	<CAAyV7nGOiVD0=z+6nJKAhr6qu96GuU4+nBTTQiizcP9DxNRUUg@mail.gmail.com>
	<009401cd6f28$b71c69c0$25553d40$@com>
	<CAAyV7nH8w5j+AQYQqh0O5eA78tjrvEzAAvKkPNPNrRFhBvDxvQ@mail.gmail.com>
	<00b701cd6f35$b2d621a0$188264e0$@com>
Date: Tue, 31 Jul 2012 12:21:31 -0400
Message-ID: <CAAyV7nHr532Bi-K0k99wSSg5RgJYLGAdusMqCYt9pRRr6LqscA@mail.gmail.com>
To: Jonathan Bond-Caron <jbondc@openmv.com>
Cc: internals@lists.php.net
Content-Type: multipart/alternative; boundary=00248c768f92421c5404c62292bf
Subject: Re: [PHP-DEV] [PROPOSED] password_hash RFC - Implementing simplified
 password hashing functions
From: ircmaxell@gmail.com (Anthony Ferrara)

--00248c768f92421c5404c62292bf
Content-Type: text/plain; charset=ISO-8859-1

Jonathan,

On Tue, Jul 31, 2012 at 12:01 PM, Jonathan Bond-Caron <jbondc@openmv.com>wrote:

> On Tue Jul 31 10:54 AM, Anthony Ferrara wrote:
> >
> > On Tue, Jul 31, 2012 at 10:28 AM, Jonathan Bond-Caron <HYPERLINK
> >
> > I strongly disagree with this, the 'pepper' IMHO is a best practice
> > for web applications.
> >
> > Again, I have not seen this being said by any security or cryptography
> > expert.
> >
>
> Like I said IMHO, I'm not a security expect but I do think there needs to
> be
> modern discussion around 'web password hashing'.


I'm not against discussion. I'm against core implementations
(or recommendation) of non-vetted cryptographic processes...


> >
> > Ok. So I register an account before I get the database. Now the only
> thing
> that I need to crack is the pepper (since I know the salt, hash and
> original
> password for my sentinel account).
>
> Fair enough ;)
>
> It can still be a problem if the pepper is large + the crypt() salt


> >
> > With all of that said, if you really want a secret in there, don't
> > hijack the hashing algorithm to do it. There are two somewhat decent
> > alternatives:
> >
> > HMAC the password with the secret prior to passing it to
> > password_hash()/crypt().  HMAC is secure and is designed for this
> > exact purpose.
> >
>
> Not so great:
> password_hash_rfc( hash_hmac('md5', 'password', '1024-bytes secret') ) //
> hmac is short (~ 160bits)
>

In that case, the HMAC would produce exactly 128 bits of output.

Why would you use MD5 for that? Use SHA512. That gives you (in your case) a
128 character password (or 64 if you pass true to the third parameter,
which you should).

Also, be aware that BCrypt only uses the first 72 characters of the
password field. So if you use a hex encoded sha512 output, a good deal of
entropy would be lost (almost half of it)...


> I guess you mean:
>
> hash_hmac('md5', password_hash_rfc('password'), '1024-bytes secret')
>
> But then there's no way to know all those crypt() parameters, salt, cost,
> etc...
>

Absolutely not. That would make the hash unverifiable...


> Maybe a new api?
> password_hash_hmac($password, $secret, $options = array());


Again, implementing something in the core that's not verified and can't be
implemented well by the vast majority of developers out there. So a big -1
from me...


> >
> > Encrypt the resulting hash with a secure encryption function
> > (RIJNDAEL_128 + CBC) prior to inserting it in the database. That way,
> > each component uses standard algorithms as they were designed to be used.
> >
>
> That's fine, I feel this should be somewhat easier in php core (without the
> need for openssl & al.)
>
> It also comes with a cost of decrypting the hashes / not so great
>

Huh? How is that not great? The encryption is actually quite fast... And
you actually want to slow down password hashing (to make it more difficult
to brute force), so I fail to see how this is an issue...


> > But I want to stress something else. Properly managing secrets is VERY
> > difficult. It's not even really possible in PHP, due to the way
> > copy-on-write works, and how variables are removed. To implement this
> > sort of a system correctly is not something even highly competent
> > developers can typically do. It really is that difficult to get right.
> >
>
> Sure managing keys properly can be hard, simple cases:
> $secret = MY_KEY;
> $secret = file_get_contents('/security/key.pem');
>

Actually, that's not properly managing the key. It requires the web server
user to be able to read the key. That allows anyone who gains permissions
as the web server (even on a different vhost) to be able to get your key.

Properly managing it would require either a dedicated cryptography server
to handle it for you, or a dedicated piece of hardware to manage the key.
Anything less is just security through obscurity...


> Again I'm making the assumption that the attacking *does not* have access
> to
> the file system.


Actually, you need to make the reverse assumption. You want to make the
data secure *even if* the attacker gets access to the filesystem. Now
obviously if they inject code into the stack they'll be able to view the
raw password from the user. But that requires long term access (and write
access). But the data stored should be protected even if the filesystem is
compromised...

--00248c768f92421c5404c62292bf--