No, SHA1 is not a secure hashing algorithm
A large percentage of the sites that fall prey to password breaches commit another error that further diminishes the protection of hashes: they use algorithms that were never designed to protect passwords. That's because SHA1, DES, and MD5 were designed to convert plaintext into hashes extremely quickly using minimal computing resources, and this is exactly what people running password cracking programs want most. (NTLM, which still uses MD4, is also highly susceptible to cracking.)
To appreciate just how poor a password hashing choice these unsalted algorithms are, consider this: It took independent security researcher Jeremi Gosney about six days to crack more than 90 percent of the 6.5 million SHA1 hashes exposed in the LinkedIn breach. He recovered a fifth of the plaintext passwords in just 30 seconds. In the following two hours, he cracked another one-third of them. One day into the exercise, he had recovered a total of 64 percent, and in the five days that followed he cracked another 26 percent.
A key part of his success—besides his 500-million-strong word list and a computer equipped with four AMD Radeon HD6990 graphics cards—was the decision by LinkedIn engineers to hash passwords using SHA1. The algorithm uses a single cryptographic iteration to convert plaintext, allowing Gosney's system to cycle through more than 15.5 billion guesses per second.
By contrast, algorithms specifically designed to protect passwords are engineered to require significantly more time and computation to convert plaintext into hashes. For instance, SHA512crypt, which is included in Mac OS X and most Unix-based operating systems, passes text through 5,000 iterations, a hurdle that would have limited Gosney to slightly less than 2,600 guesses per second. The Bcrypt algorithm is even more computationally expensive, in large part because it subjects text to multiple iterations of the Blowfish cipher that was deliberately modified to increase the time required to generate a hash. PBKDF2, a function built into Microsoft's .Net software developer framework, offers similar benefits.
These computationally expensive functions require increased server processing, of course. This can increase the strain on Web servers and could even open them up to new types of DoS attacks, said Matt Weir, a Florida State University post-doctoral student whose PhD focused on passcodes. But the benefit in improved security largely outweighs the investment, many security experts argue. Had LinkedIn engineers used Bcrypt, for example, Gosney would have been able to make fewer than 1,750 guesses per second.
"If the LinkedIn passwords had been hashed using bcrypt, I never would have been able to crack 90 percent of them," he told Ars in an e-mail. "The number of attacks I had to run, combined with the sophistication of the attacks I had to run to get many of the passwords [more than] 15 characters, would have taken literally centuries to finish. I would have given up after about a week."
Hitting the wall
Even powerful computation engines have trouble cracking longer passwords using brute force. Assuming such an attack checks for all combinations of all 95 letters, numbers, and symbols available on a standard English-language keyboard, it takes a matter of hours for a desktop computer with an Intel Core i7 980x processor to brute-force crack any five character password. Increasing the password length by just one character requires about a day; bumping the length by one more character, though, dramatically increases the cracking time to more than 10 days. Rob Graham, the Errata Security CEO who calculated the requirements, refers to this limitation as the "exponential wall of brute-force cracking."
Adding a GPU card to a system undoubtedly helps, but not as much as many might imagine. An AMD Radeon 6970 still needs more than 10 days to brute force a seven-character passcode. And the wall barely budges even when significantly more powerful resources are brought to bear. Using an Amazon EC2 cloud system that combines the horsepower of more than 1,000 individual GPUs, it still takes about 10 days to brute-force an eight character password.
But with few exceptions, the exponential wall rarely impedes most password crackers. As demonstrated by the RockYou dump, the typical person is notoriously sloppy when choosing a passcode. A full 70 percent of them contained eight characters or less. Only 14 million of the 32 million total were unique, showing that a large percentage of passwords are duplicates. Atom, the Hashcat developer and password-cracking expert, estimates that 66 percent of entries from the typical unsalted hash list can be cracked by a single person in less than two days.
So what can the average person do to pick a passcode that won't be toppled in a matter of hours? Per Thorsheim, a security advisor who specializes in passwords for a large company headquartered in Norway, said the most important attribute of any passcode is that it be unique to each site.
"For most sites, you have no idea how they store your password," he explained. "If they get breached, you get breached. If your password at that site is unique, you have much less to worry about."
It's also important that a password not already be a part of the corpus of the hundreds of millions of codes already compiled in crackers' word lists, that it be randomly generated by a computer, and that it have a minimum of nine characters to make brute-force cracks infeasible. Since it's not uncommon for people to have dozens of accounts these days, the easiest way to put this advice into practice is to use program such as 1Password or PasswordSafe. Both apps allow users to create long, randomly generated passwords and to store them securely in a cryptographically protected file that's unlocked with a single master password. Using a password manager to change passcodes regularly is also essential.
Given the sophistication of the crackers, anything less simply means your password is trivial to break.
"The whole password-cracking scene has changed drastically in the last couple years," said Weir, the Florida State University post-doctoral student. "You can look online and you can generally find passwords for just about everyone at some point. I've found my own username and passwords on several different sites. If you think every single website you have an account on is secure and has never been hacked, you're a much more optimistic person than I am."