Password Hashing and Storage

Introduction

Password security is a critical aspect of protecting user accounts and data. SSOJet employs robust methods and protocols for password hashing and storage to ensure that passwords are securely stored and resistant to unauthorized access and attacks. This document provides a detailed overview of the password hashing and storage practices used by SSOJet.

Scope

This document covers the following aspects of password hashing and storage:

Password hashing algorithms

Salting techniques

Storage methods

Best practices

Regular audits and updates

Password Hashing Algorithms

SSOJet uses industry-standard hashing algorithms to securely hash passwords. The algorithms are chosen based on their security, efficiency, and resistance to attacks such as brute force and rainbow table attacks.

bcrypt

Description: bcrypt is a widely-used password hashing algorithm that incorporates a salt to protect against rainbow table attacks and an adaptive cost factor to prevent brute force attacks.

Cost Factor: The cost factor can be adjusted to increase the computational effort required to hash a password, making it more resistant to brute force attacks.

Implementation: bcrypt is implemented using the bcrypt library, which is a well-maintained and widely-accepted library for password hashing.

Argon2

Description: Argon2 is an advanced password hashing algorithm that won the Password Hashing Competition in 2015. It is designed to be resistant to GPU cracking attacks and offers configurable memory and time costs.

Memory and Time Costs: Argon2 allows the customization of memory and time costs to balance security and performance.

Implementation: Argon2 is implemented using the argon2 library, which is recommended for new applications due to its enhanced security features.

Salting Techniques

Salting is a technique used to add random data to passwords before hashing to ensure that even identical passwords produce unique hashes.

Unique Salt per Password

Generation: A unique salt is generated for each password using a cryptographically secure random number generator.

Length: The salt length is typically 16 bytes, providing sufficient randomness to protect against pre-computed attacks.

Storage: Salts are stored alongside the hashed passwords in the database.

Combining Salt with Password

Process: The salt is concatenated with the password before hashing, ensuring that each hash is unique even if the passwords are the same.

Format: The salt and hashed password are stored together in a standardized format, such as $algorithm$salt$hash.

Storage Methods

Securely storing hashed passwords is crucial to preventing unauthorized access and ensuring data integrity.

Encrypted Databases

Encryption: Password hashes and salts are stored in encrypted databases to provide an additional layer of security.

Encryption Algorithms: AES-256 is used for database encryption, ensuring that data is protected even if the database is compromised.

Environment Isolation

Separation of Environments: The environments used for hashing and storing passwords are isolated to minimize the risk of unauthorized access.

Access Control: Strict access control measures are implemented to limit access to the environments where password hashing and storage occur.

Best Practices

SSOJet follows best practices for password hashing and storage to enhance security and mitigate risks.

Regular Audits

Frequency: Conduct regular audits of password hashing and storage practices to identify and address potential vulnerabilities.

Third-Party Audits: Engage third-party security firms to perform independent audits and penetration testing.

Hash Updates

Algorithm Updates: Periodically review and update hashing algorithms to ensure they remain secure against evolving threats.

Rehashing: Implement mechanisms to rehash passwords using updated algorithms and cost factors when users log in or change their passwords.

User Education

Strong Password Policies: Educate users about the importance of creating strong, unique passwords.

Password Managers: Encourage users to use password managers to generate and store complex passwords securely.

Regular Audits and Updates

SSOJet is committed to maintaining the highest level of security for password hashing and storage through regular audits and updates.

Audit Procedures

Internal Audits: Conduct regular internal audits to review and assess the effectiveness of password hashing and storage practices.

Audit Reports: Document audit findings and implement corrective actions as needed.

Algorithm and Cost Factor Reviews

Periodic Reviews: Regularly review and update the hashing algorithms and cost factors to ensure they remain secure against new attack vectors.

Rehashing Mechanisms: Implement mechanisms to rehash passwords when users log in or change their passwords, ensuring that they are protected by the latest security measures.

Conclusion

SSOJet employs robust and industry-standard practices for password hashing and storage to ensure the security and integrity of user accounts. By using strong hashing algorithms, unique salts, encrypted storage, and following best practices, we provide a high level of protection against unauthorized access and attacks. Regular audits and updates ensure that our security measures remain effective and up-to-date with the latest advancements and threats.

For any security-related inquiries or to report a security incident, please contact our security team at:

Email: support@ssojet.com

This detailed document on password hashing and storage provides a comprehensive overview of the security measures and practices employed by SSOJet. It can be expanded or tailored based on specific organizational needs and security policies.