1816
Use an adaptive hash function that can be configured to change the amount of computational
effort needed to compute the hash, such as the number of iterations ("stretching") or the amount
of memory required. Some hash functions perform salting automatically. These functions
can significantly increase the overhead for a brute force attack compared to intentionally-fast
functions such as MD5. For example, rainbow table attacks can become infeasible due to the
high computing overhead. Finally, since computing power gets faster and cheaper over time, the
technique can be reconfigured to increase the workload without forcing an entire replacement
of the algorithm in use. Some hash functions that have one or more of these desired properties
include bcrypt [REF-291], scrypt [REF-292], and PBKDF2 [REF-293]. While there is active
debate about which of these is the most effective, they are all stronger than using salts with
hash functions with very little computing overhead. Note that using these functions can have an
impact on performance, so they require special consideration to avoid denial-of-service attacks.
However, their configurability provides finer control over how much CPU and memory is used, so
it could be adjusted to suit the environment's needs.
Effectiveness = High
Phase: Implementation
Phase: Architecture and Design
When using industry-approved techniques, use them correctly. Don't cut corners by skipping
resource-intensive steps (CWE-325). These steps are often essential for preventing common
attacks.
Demonstrative Examples
Example 1:
In this example, a new user provides a new username and password to create an account. The
program hashes the new user's password then stores it in a database.
Example Language: Python (Bad)
def storePassword(userName,Password):
hasher = hashlib.new('md5')
hasher.update(Password)
hashedPassword = hasher.digest()
# UpdateUserLogin returns True on success, False otherwise
return updateUserLogin(userName,hashedPassword)
While it is good to avoid storing a cleartext password, the program does not provide a salt to the
hashing function, thus increasing the chances of an attacker being able to reverse the hash and
discover the original password if the database is compromised.
Fixing this is as simple as providing a salt to the hashing function on initialization:
Example Language: Python (Good)
def storePassword(userName,Password):
hasher = hashlib.new('md5',b'SaltGoesHere')
hasher.update(Password)
hashedPassword = hasher.digest()
# UpdateUserLogin returns True on success, False otherwise
return updateUserLogin(userName,hashedPassword)
Note that regardless of the usage of a salt, the md5 hash is no longer considered secure, so this
example still exhibits CWE-327.
Observed Examples
Reference Description
CVE-2008-1526 Router does not use a salt with a hash, making it easier to crack passwords.
https://www.cve.org/CVERecord?id=CVE-2008-1526
CWE Version 4.14
CWE-916: Use of Password Hash With Insufficient Computational Effort
CWE-916: Use of Password Hash With Insufficient Computational Effort