The Use of Hashed PasswordsA widely

The Use of Hashed Passwords
A widely used password security technique is the use of hashed passwords and a salt
value. This scheme is found on virtually all UNIX variants as well as on a number
of other operating systems. The following procedure is employed ( Figure 3.1a ). To
load a new password into the system, the user selects or is assigned a password. This
password is combined with a fixed-length salt value [MORR79]. In older implementations,
this value is related to the time at which the password is assigned to the user.
Newer implementations use a pseudorandom or random number. The password
and salt serve as inputs to a hashing algorithm to produce a fixed-length hash code.
The hash algorithm is designed to be slow to execute to thwart attacks. The hashed
password is then stored, together with a plaintext copy of the salt, in the password
file for the corresponding user ID. The hashed-password method has been shown to
be secure against a variety of cryptanalytic attacks [WAGN00].
When a user attempts to log on to a UNIX system, the user provides an ID
and a password (Figure 3.1b). The operating system uses the ID to index into the
password file and retrieve the plaintext salt and the encrypted password. The salt
and user-supplied password are used as input to the encryption routine. If the result
matches the stored value, the password is accepted.
The salt serves three purposes:
• It prevents duplicate passwords from being visible in the password file. Even if
two users choose the same password, those passwords will be assigned different
salt values. Hence, the hashed passwords of the two users will differ.
• It greatly increases the difficulty of offline dictionary attacks. For a salt of
length b bits, the number of possible passwords is increased by a factor of 2b,
increasing the difficulty of guessing a password in a dictionary attack.
• It becomes nearly impossible to find out whether a person with passwords on
two or more systems has used the same password on all of them.