Exercise: Hashing, Password security, And File Integrity NOTE: To change the image on this slide, select the picture and delete it. Then click the Pictures icon in the placeholder to insert your own image. Introduction to Cryptography

Background Password Security It is critical to create strong password for authentication in computer application today. When easy-to-guess or common passwords are used, there are hacking techniques that attackers can use to retrieve the password’s plaintext. When creating a password, it is stored in a back-end database. The password’s hash value is stored instead of its’ plaintext value. Encryption vs. Hashing for Password Storage Passwords are reversible. If passwords were strong encrypted, and an attacker successfully steals the encrypted password, they may figure out the key and reverse the encrypted password into plaintext. Hashing is a better option for storing passwords because a strong hashing algorithm is irreversible. If an attacker steals a strong password that is hashed, it would be impossible to reverse.

Background Hashing Process When logging into a website with a user ID and password, the back-end database uses the ID to look up the associated hash value. The submitted password is hashed with the hashing algorithm the site uses. If the resulting hash is the same as the one stored on the back-end the user is authenticated and granted access to the site. Rainbow Tables When easy-to-guess or common passwords are hashed, an attacker could use rainbow tables to retrieve the password’s plaintext. Rainbow tables make it possible to brute force attack hashed messages. A brute force attack attempts every possible combination to retrieve the plaintext of encrypted values. Rainbow tables have pre- configured hash values associated with easy-to-guess or common passwords.

Exercise: Scenario Creating Passwords for Easy to Guess Passwords Go to https://passwordsgenerator.net/sha256-hash-generator/. We want to create SHA256 bit a hash value for password pass1234. Type “pass1234” in the “Enter your text below” box. Scroll down to “SHA256 Hash of your string” to see the generated string. Go to https://crackstation.net/. Copy the SHA256 “pass1234” string in the box on this website. Check the reCAPTCHA box and click “Crack Hash” . Were you able to crack the hash? Why or why not?

Exercise: Scenario Creating Passwords for Easy to Guess Passwords Go to https://passwordsgenerator.net/sha256-hash-generator/. Create a SHA256 bit hash value for password Crypt_ex3&. Type Crypt_ex3& in the “Enter your text below” box. Scroll down to “SHA256 Hash of your string” to see the generated string. Go to https://crackstation.net/. Copy the SHA256 Crypt_ex3& string in the box on this website. Check the reCAPTCHA box and click “Crack Hash” . Were you able to crack the hash? Why or why not?

Background Salts Salts provide an additional layer of protection for stored passwords. The issue with hashes without salts is that if two user create the same password it creates the same hash value making is easier for attackers to use rainbow tables to ______ passwords. Salts are random strings added to before the password is hashed. The following image is an example of how when the password “hello” is salted it creates different hash values: https://crackstation.net/hashing-security.htm

Exercise Salting a Message Argon2, Password-Based Key Derivation Function 2 (PBKDF2) ,Scrypt, and Bcrypt are password hashing technologies that have salts built in. 1. Go to https://asecuritysite.com/encryption/PBKDF2z. In the “Message (or pass phrase) type “pass1234”. Click “Generate Hash”. Record the “Hash (Hex)” value. 2. Go to https://crackstation.net/. Copy the salted hash of “pass1234” in the box. Check the ________ and click “Crack Hash”. What difference do you notice from when you tried to crack this password with and without the salt? 3. Go to https://asecuritysite.com/encryption/PBKDF2z. In the “Message (or pass phrase) type “Cryp_ex3&”. Click “Generate Hash”. Record the “Hash (Hex)” value. 4. Go to https://crackstation.net/. Copy the salted hash of “Cryp_ex3&” in the box. Check the ________ and click “Crack Hash”. Were you able to crack the hash?

Takeaways It is important to create strong passwords that are not easy-to-guess or common. Hashes protect password while they are stored Rainbow tables can _________ weak and/or easy-to-guess hashed passwords. Salts can protect even weak passwords from brute force attacks using rainbow tables.