Password Security and Hashing

# CHAPTER 7

Password Security and Hashing #

1. Introduction #

2. Learning Objectives #

• Understand why storing passwords in plaintext or using two-way encryption is a severe security failure.

• Explain the password hashing authentication workflow.

• Define a "Rainbow Table" attack.

• Understand the critical role of Cryptographic Salting.

• Identify secure password hashing algorithms (Bcrypt, Argon2) vs. fast hashing algorithms (SHA-256).

3. Beginner-Friendly Explanation #

• Plaintext (Bad): You tell the bouncer your secret password ("Apple"). He writes "Apple" in a notebook. A thief steals the notebook and knows everyone's password.

• Hashing (Better): You say "Apple." The bouncer puts "Apple" through a math formula, turning it into #8xZ. He writes #8xZ in the notebook. When you come back, you say "Apple", he does the math again, gets #8xZ, checks the notebook, and lets you in. If the thief steals the notebook, they only see #8xZ, which they can't reverse.

• Salting (Best): Two people both choose the password "Apple". To prevent them from having the exact same #8xZ in the notebook, the bouncer adds a random word (a Salt) to the end before doing the math. Person A becomes "Apple+Dog". Person B becomes "Apple+Cat". They now have completely different entries in the notebook, confusing the thief.

4. Why Not Encryption? #

5. Rainbow Tables and Brute Force #

6. The Defense: Salting #

7. Mini Project: Build a Secure Password Hash (PHP Concept) #

The Right Way (Bcrypt):

// 1. User registers with a password
$password = 'MySecretPassword123!';

// 2. The server automatically generates a Salt and hashes it using Bcrypt
$passwordHash = password_hash($password, PASSWORD_BCRYPT);
// The resulting $passwordHash looks like: $2y$10$w... (It includes the algorithm, cost factor, and salt!)

// 3. User tries to log in later
$loginAttempt = 'MySecretPassword123!';

// 4. The server verifies the attempt against the stored hash
if (password_verify($loginAttempt, $passwordHash)) {
    echo "Login successful!";
} else {
    echo "Invalid password.";
}

8. Real-World Scenarios #

9. Best Practices #

• Use Slow Algorithms (Key Stretching): SHA-256 is designed to be incredibly fast. A modern GPU can calculate 50 billion SHA-256 hashes per second. This is *terrible* for password security. You want a slow algorithm. Algorithms like Bcrypt or Argon2 have a "Cost Factor" that intentionally forces the computer to spend a quarter of a second calculating the hash. For a normal user logging in, a quarter-second delay is unnoticeable. For a hacker trying to guess 1 billion passwords, that delay makes the attack mathematically impossible.

10. Legal and Ethical Notes #

11. Exercises #

1. 1. Explain why a Rainbow Table is highly effective against unsalted hashes, but completely useless against salted hashes.

1. 2. Why is an algorithm like SHA-256 considered excellent for verifying file integrity, but a poor choice for hashing user passwords?

12. FAQs #

13. Interview Questions #

• Q: Detail the cryptographic workflow of authenticating a user via a salted hash. Why is it architecturally safer than storing an AES-encrypted password?

• Q: Compare and contrast the use cases for SHA-256 versus Argon2. In a modern web application, where would you deploy each algorithm?

14. Summary #

15. Next Chapter Recommendation #