{"id":540,"date":"2021-12-16T09:36:50","date_gmt":"2021-12-16T08:36:50","guid":{"rendered":"https:\/\/infosecscout.com\/?p=540"},"modified":"2024-01-06T06:42:51","modified_gmt":"2024-01-06T05:42:51","slug":"best-algorithm-password-storage","status":"publish","type":"post","link":"https:\/\/infosecscout.com\/best-algorithm-password-storage\/","title":{"rendered":"What&#8217;s The Best Algorithm For User Credential Storage In 2024?"},"content":{"rendered":"\n<p>User credential (which refers to username and password combinations used for accessing online accounts) are very sensitive data sets that must necessarily be protected. Attack to such data sets lead to the financial ruin, sabotage or exposure of confidential materials belonging to individuals and financial and integrity ruin for organizations.<\/p>\n\n\n\n<p><strong>There has been appreciable development in the evolution of storage algorithms. Some existing storage algorithms include, the MD, SHA, Bcrypt, Scrypt and Argon. Presently, Argon2 seems the holy grail of storage algorithms when it comes to user credentials. This is due to its remarkable flexibility and superior security capabilities.<\/strong><\/p>\n\n\n\n<p>In what follows, I will analyze why Argon2 take the number one spot on my preference list and why other alternatives trail behind rather sluggishly.<\/p>\n\n\n\n<div id=\"ez-toc-container\" class=\"ez-toc-v2_0_65 counter-hierarchy ez-toc-counter ez-toc-custom ez-toc-container-direction\">\n<div class=\"ez-toc-title-container\">\n<p class=\"ez-toc-title \" >Table of Contents<\/p>\n<span class=\"ez-toc-title-toggle\"><a href=\"#\" class=\"ez-toc-pull-right ez-toc-btn ez-toc-btn-xs ez-toc-btn-default ez-toc-toggle\" aria-label=\"Toggle Table of Content\"><span class=\"ez-toc-js-icon-con\"><span class=\"\"><span class=\"eztoc-hide\" style=\"display:none;\">Toggle<\/span><span class=\"ez-toc-icon-toggle-span\"><svg style=\"fill: #999;color:#999\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" class=\"list-377408\" width=\"20px\" height=\"20px\" viewBox=\"0 0 24 24\" fill=\"none\"><path d=\"M6 6H4v2h2V6zm14 0H8v2h12V6zM4 11h2v2H4v-2zm16 0H8v2h12v-2zM4 16h2v2H4v-2zm16 0H8v2h12v-2z\" fill=\"currentColor\"><\/path><\/svg><svg style=\"fill: #999;color:#999\" class=\"arrow-unsorted-368013\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"10px\" height=\"10px\" viewBox=\"0 0 24 24\" version=\"1.2\" baseProfile=\"tiny\"><path d=\"M18.2 9.3l-6.2-6.3-6.2 6.3c-.2.2-.3.4-.3.7s.1.5.3.7c.2.2.4.3.7.3h11c.3 0 .5-.1.7-.3.2-.2.3-.5.3-.7s-.1-.5-.3-.7zM5.8 14.7l6.2 6.3 6.2-6.3c.2-.2.3-.5.3-.7s-.1-.5-.3-.7c-.2-.2-.4-.3-.7-.3h-11c-.3 0-.5.1-.7.3-.2.2-.3.5-.3.7s.1.5.3.7z\"\/><\/svg><\/span><\/span><\/span><\/a><\/span><\/div>\n<nav><ul class='ez-toc-list ez-toc-list-level-1 eztoc-toggle-hide-by-default' ><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-1\" href=\"https:\/\/infosecscout.com\/best-algorithm-password-storage\/#User_Credential_Storage_Algorithms_to_Avoid\" title=\"User Credential Storage Algorithms to Avoid\">User Credential Storage Algorithms to Avoid<\/a><ul class='ez-toc-list-level-3' ><li class='ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-2\" href=\"https:\/\/infosecscout.com\/best-algorithm-password-storage\/#MD5\" title=\"MD5\">MD5<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-3\" href=\"https:\/\/infosecscout.com\/best-algorithm-password-storage\/#SHA\" title=\"SHA\">SHA<\/a><\/li><\/ul><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-4\" href=\"https:\/\/infosecscout.com\/best-algorithm-password-storage\/#Top_3_algorithms_to_choose_for_storing_user_passwords\" title=\"Top 3 algorithms to choose for storing user passwords\">Top 3 algorithms to choose for storing user passwords<\/a><ul class='ez-toc-list-level-3' ><li class='ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-5\" href=\"https:\/\/infosecscout.com\/best-algorithm-password-storage\/#Bcrypt\" title=\"Bcrypt\">Bcrypt<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-6\" href=\"https:\/\/infosecscout.com\/best-algorithm-password-storage\/#Scrypt\" title=\"Scrypt\">Scrypt<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-7\" href=\"https:\/\/infosecscout.com\/best-algorithm-password-storage\/#Argon_2\" title=\"Argon 2\">Argon 2<\/a><\/li><\/ul><\/li><\/ul><\/nav><\/div>\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"User_Credential_Storage_Algorithms_to_Avoid\"><\/span><strong>User Credential Storage Algorithms to Avoid<\/strong><span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<h3 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"MD5\"><\/span><strong>MD5<\/strong><span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<p>One of the oldest credential storage algorithm is the Message Digest Algorithm (MD5). The MD5 is a cryptography hashing algorithm. It constitutes part of the larger Message Digest Algorithm cluster which originally was created to authenticate the integrity of hashed message. MD5 is the product of incremental developments made on the earlier installments of the Message Digest Algorithm which are the MD2 and MD4.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"511\" height=\"52\" src=\"https:\/\/infosecscout.com\/wp-content\/uploads\/2021\/12\/md5sum.jpg\" alt=\"\" class=\"wp-image-545\" srcset=\"https:\/\/infosecscout.com\/wp-content\/uploads\/2021\/12\/md5sum.jpg 511w, https:\/\/infosecscout.com\/wp-content\/uploads\/2021\/12\/md5sum-300x31.jpg 300w\" sizes=\"(max-width: 511px) 100vw, 511px\" \/><\/figure>\n\n\n\n<p>MD5 is used for a variety of reasons including the storage of employee credentials. However, the MD5 has been appraised by numerous expert bodies and due to the results of numerous security analysis to be insecure and therefore not to be used on any applications.<\/p>\n\n\n\n<p>In addition, the MD5 is a memory saving algorithm and this design allows the hacker to figure the hash of very huge number of passwords in a short time using the ASICs or FGPA arrays.<\/p>\n\n\n\n<p><strong>A major problem of the MD5 is that the MD5 password hashes are very fast. This means that hackers can find their way into the system by trying many password possibilities. This implies that with the MD5, brute force attacks are more likely than not to occur.<\/strong> <\/p>\n\n\n\n<p>Experts therefore recommend the Secure Hash Algorithm (SHA) in place of the MD5 to combat its weaknesses.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"SHA\"><\/span><strong>SHA<\/strong><span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<p>The Secure Hash Algorithm (SHA) are a cluster of cryptographic hash functions. It was originally designed to improve on the weaknesses of the MD4 which was the second development of the Message Digest Algorithm family. It breaks credentials into smaller bits and creates a string of 160 bits (20 byte) also known as message digest.<\/p>\n\n\n\n<p>The cryptographic functions are used to store data in the form of three different characteristics, such as pre-image resistance and collision resistance.<\/p>\n\n\n\n<ul><li><strong>Elimination of the Weaknesses of MD5: <\/strong>By collision resistance, the SH algorithm eliminates the weakness of the MD5 system which makes it possible for new words with the same hash to be sent into the system. With this, it prevents the validation of malicious contents and files and by pre-image resistance, SHA eliminates the possibility that two passwords in the system will have the same hash identity.<\/li><li><strong>Time Consuming for Hackers: <\/strong>It makes it more time consuming for hackers to break into any system. There are four SHA algorithms which are SHA 0, SHA 1, SHA 2, and SHA 3, each possessing minor modifications and advancements on the weaknesses of the other.<\/li><\/ul>\n\n\n\n<p><strong>Weaknesses of the MD5 and SHA Algorithms<\/strong>:<\/p>\n\n\n\n<p>The MD5 and SHA clusters are extremely fast when it comes to data computation but this is not necessarily good for password storage for the following reasons:<\/p>\n\n\n\n<ul><li>Faster computing makes it easier for brute-force attacks to prevail. Hence, making organizations vulnerable to such attacks.<\/li><li>In addition, MD5 and SHA don\u2019t have mandatory salt as added protection for the storage of hashed passwords.<\/li><\/ul>\n\n\n\n<p>While MD5 and SHA algorithms clusters are not without their numerous advantages, experts have advised against using them due to their vulnerability to the increasingly sophisticated dynamics of cyber-attacks within the business environment to gain access to employee credentials.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Top_3_algorithms_to_choose_for_storing_user_passwords\"><\/span><strong>Top 3 algorithms to choose for storing user passwords<\/strong><span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<h3 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Bcrypt\"><\/span><strong>Bcrypt<\/strong><span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<p><strong>Bcrypt, unlike MD5 and SHA includes additional protection which makes it impossible for brute force attacks to prevail. Bcrypt is often referred to as CPU hardened algorithm. Meaning that computing a single hash on the Bcrypt system requires multiple CPU cycles.<\/strong><\/p>\n\n\n\n<p>Unlike MD5 and SHA, Bcrypt increases difficulty and impenetrability to brute force system entry. Bcrypt allows one to design a number of iterations using specific work factors which slows down computing speed. One can simply increase work factor of the Bcrypt to increase resource consumption. This also makes it a mandatory requirement for hackers to deploy very expensive campaigns and huge time efforts to breaking through Bcrypt systems. Thus making brute force entrance almost impossible when the bcrypt algorithm is utilized.<\/p>\n\n\n\n<p>Bcrypt, however, provides very limited security and its weaknesses to a large extent are protected by another storage algorithm known as Scrypt.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Scrypt\"><\/span><strong>Scrypt<\/strong><span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<p>Scrypt is also a hardened function but is very advantageous because it consumes a lot of memory space. Script provides ample room for control and flexibility as the developer employing the algorithm can determine the memory and computing resources required. <\/p>\n\n\n\n<p>In other words, <strong>attack campaigns against Scrypt algorithms are very cost intensive due to their huge memory and computation requirements<\/strong>.<\/p>\n\n\n\n<p>When it comes to memory hardness, Scrypt is preferable to Bcrypt and has a wide usage with implementation of the ASIC and FGPA technologies on it. At best, however, Scrypt no doubt provides an improvement on the weaknesses of Bcrypt, yet, the protection it provides is far from perfect. The loopholes of Bcrypt and Scrypt led to the development of the Argon storage algorithms.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Argon_2\"><\/span><strong>Argon 2<\/strong><span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<p><strong>The Argon 2 algorithm provides the most flexibility. It won the password hashing competition in July 2015. It is considered an improvement on the Bcrypt and Scrypt algorithms, it has a pre-defined memory size, the element of CPU time and parallelism.<\/strong><\/p>\n\n\n\n<p>These elements combine to make brute force attacks very expensive because it requires attackers to have large memories for computation and memory resources. Argon2 has the <em>2i<\/em> and <em>2d<\/em> variations. The former is effective in protection against side channel attacks while the latter provides stronger protection against GPU cracking attacks.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"203\" src=\"https:\/\/infosecscout.com\/wp-content\/uploads\/2021\/12\/argon2-command-line-1024x203.jpg\" alt=\"\" class=\"wp-image-544\" srcset=\"https:\/\/infosecscout.com\/wp-content\/uploads\/2021\/12\/argon2-command-line-1024x203.jpg 1024w, https:\/\/infosecscout.com\/wp-content\/uploads\/2021\/12\/argon2-command-line-300x60.jpg 300w, https:\/\/infosecscout.com\/wp-content\/uploads\/2021\/12\/argon2-command-line-768x153.jpg 768w, https:\/\/infosecscout.com\/wp-content\/uploads\/2021\/12\/argon2-command-line.jpg 1158w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>Argon2i employs an isolated memory access, which is best for password storage. The hybrid version of the Argon storage technology complements combines the strength of 2i and 2d to provide all rounded security. Argon2id performs as 2i for at least 50 percent of the first iteration over the memory and as 2d for the rest of the operations.<\/p>\n\n\n\n<p>The storage technology, unlike Bcrypt and Scrypt, provides protection against side-channel attacks and brute force entries as well as tradeoff attacks<\/p>\n\n\n\n<p>Argon2 converts password inputs from their human readable form to a string of gibberish which cannot be converted back to original inputs from which they were created. And when database is lost while the created string of gibberish is lost, the original value remains intact.<\/p>\n\n\n\n<p><strong>Argon2\u2019s fundamental design makes it resistant to tradeoff attacks and makes it more difficult to cheaply optimize on-field programming gateway arrays. Argon2d employs memory access which depends on data, making it suitable for cryptocurrencies and other applications to heave sighs of relief when it comes to side channel timing attacks.<\/strong><\/p>\n\n\n\n<p>It is quite clear, more so, proven by security investigations, that the Argon storage algorithms provides the best protection when compared to earlier listed algorithms. I therefore present to you, without a shadow of doubt the most reliable user password storage algorithm, its name, Argon.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>User credential (which refers to username and password combinations used for accessing online accounts) are very sensitive data sets that must necessarily be protected. Attack to such data sets lead to the financial ruin, sabotage or exposure of confidential materials belonging to individuals and financial and integrity ruin for organizations. There has been appreciable development&#8230;<\/p>\n","protected":false},"author":1,"featured_media":548,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_kad_blocks_custom_css":"","_kad_blocks_head_custom_js":"","_kad_blocks_body_custom_js":"","_kad_blocks_footer_custom_js":"","_kad_post_transparent":"","_kad_post_title":"","_kad_post_layout":"","_kad_post_sidebar_id":"","_kad_post_content_style":"","_kad_post_vertical_padding":"","_kad_post_feature":"","_kad_post_feature_position":"","_kad_post_header":false,"_kad_post_footer":false,"footnotes":""},"categories":[14],"tags":[],"taxonomy_info":{"category":[{"value":14,"label":"Security"}]},"featured_image_src_large":["https:\/\/infosecscout.com\/wp-content\/uploads\/2021\/12\/best-algorithm-password-storage-1024x683.jpg",1024,683,true],"author_info":{"display_name":"Patrick Fromaget","author_link":"https:\/\/infosecscout.com\/about\/"},"comment_info":0,"category_info":[{"term_id":14,"name":"Security","slug":"security","term_group":0,"term_taxonomy_id":14,"taxonomy":"category","description":"Check out our easy-to-follow tips and facts in Security Information. Learn how passwords work and more, all explained in a way that's easy to understand.","parent":0,"count":21,"filter":"raw","cat_ID":14,"category_count":21,"category_description":"Check out our easy-to-follow tips and facts in Security Information. Learn how passwords work and more, all explained in a way that's easy to understand.","cat_name":"Security","category_nicename":"security","category_parent":0}],"tag_info":false,"_links":{"self":[{"href":"https:\/\/infosecscout.com\/wp-json\/wp\/v2\/posts\/540"}],"collection":[{"href":"https:\/\/infosecscout.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/infosecscout.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/infosecscout.com\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/infosecscout.com\/wp-json\/wp\/v2\/comments?post=540"}],"version-history":[{"count":8,"href":"https:\/\/infosecscout.com\/wp-json\/wp\/v2\/posts\/540\/revisions"}],"predecessor-version":[{"id":1468,"href":"https:\/\/infosecscout.com\/wp-json\/wp\/v2\/posts\/540\/revisions\/1468"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/infosecscout.com\/wp-json\/wp\/v2\/media\/548"}],"wp:attachment":[{"href":"https:\/\/infosecscout.com\/wp-json\/wp\/v2\/media?parent=540"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/infosecscout.com\/wp-json\/wp\/v2\/categories?post=540"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/infosecscout.com\/wp-json\/wp\/v2\/tags?post=540"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}