Lecture

Data Security: Hashing, Salting, and Password Storage

Graph Chat

Chat with Graph Search

Ask any question about EPFL courses, lectures, exercises, research, news, etc. or try the example questions below.

DISCLAIMER: The Graph Chatbot is not programmed to provide explicit or categorical answers to your questions. Rather, it transforms your questions into API requests that are distributed across the various IT services officially administered by EPFL. Its purpose is solely to collect and recommend relevant references to content that you can explore to help you answer your questions.

In course

COM-402: Information security and privacy

This course provides an overview of information security and privacy topics. It introduces students to the knowledge and tools they will need to deal with the security/privacy challenges they are likely to encounter in today's world. The tools are illustra ...

Description

This lecture covers the importance of hashing, salting, and password storage in data security. The instructor discusses the risks of storing passwords in clear text, the benefits of using salt to protect against dictionary attacks, and the concept of memory hard functions to slow down password cracking. The lecture also delves into the implementation of secure remote password protocols (SRP) using password authentication key exchange (PAKE) to securely verify passwords without transmitting them over the network.

Instructors (4)

Jean-Pierre Hubaux

Jean-Pierre Hubaux is a full professor at EPFL and head of the Laboratory for Data Security. Through his research, he contributes to laying the foundations and developing the tools for protecting privacy in today’s hyper-connected world. He has pioneered the areas of privacy and security in mobile/wireless networks and in personalized health. He is the academic director of the Center for Digital Trust (C4DT). He leads the Data Protection in Personalized Health (DPPH) project funded by the ETH Council and is a co-chair of the Data Security Work Stream of the Global Alliance for Genomics and Health (GA4GH). From 2008 to 2019 he was one of the seven commissioners of the Swiss FCC. He is a Fellow of both IEEE (2008) and ACM (2010). Recent awards: two of his papers obtained distinctions at the IEEE Symposium on Security and Privacy in 2015 and 2018. He is among the most cited researchers in privacy protection and in information security. Spoken languages: French, English, German, Italian

James Richard Larus

Expertise James Larus is a Professor Emeritus and former Dean of the School of Computer and Communication Sciences (IC) at EPFL (école Polytechnique Fédérale de Lausanne). Before joining IC in October 2013, Larus was a researcher, manager, and director in Microsoft Research for over 16 years and an Assistant and Associate Professor in the Computer Sciences Department at the University of Wisconsin, Madison.Larus has been an active contributor to numerous communities. He published over 100 papers (with 14 be

Mathias Josef Payer

Mathias Payer is a security researcher and professor at the EPFL school of computer and communication sciences (IC), leading the HexHive group. His research focuses on protecting applications in the presence of vulnerabilities, with a focus on memory corruption and type violations. He is interested in software security, system security, binary exploitation, effective mitigations, fault isolation/privilege separation, strong sanitization, and software testing (fuzzing) using a combination of binary analysis and compiler-based techniques. More details are available in his CV.

Marcel Busch

Official source

Related concepts (32)

Password

A password, sometimes called a passcode (for example in Apple devices), is secret data, typically a string of characters, usually used to confirm a user's identity. Traditionally, passwords were expected to be memorized, but the large number of password-protected services that a typical individual accesses can make memorization of unique passwords for each service impractical. Using the terminology of the NIST Digital Identity Guidelines, the secret is held by a party called the claimant while the party verifying the identity of the claimant is called the verifier.

Password manager

A password manager is a computer program that allows users to store and manage their passwords for local applications or online services such as web applications, online shops or social media. Password managers can generate passwords and fill online forms. Password managers may exist as a mix of: computer applications, mobile applications, or as web browser extensions. A password manager may assist in generating passwords, storing passwords, usually in an encrypted database.

Authentication protocol

An authentication protocol is a type of computer communications protocol or cryptographic protocol specifically designed for transfer of authentication data between two entities. It allows the receiving entity to authenticate the connecting entity (e.g. Client connecting to a Server) as well as authenticate itself to the connecting entity (Server to a client) by declaring the type of information needed for authentication as well as syntax. It is the most important layer of protection needed for secure communication within computer networks.

Mutual authentication

Mutual authentication or two-way authentication (not to be confused with two-factor authentication) refers to two parties authenticating each other at the same time in an authentication protocol. It is a default mode of authentication in some protocols (IKE, SSH) and optional in others (TLS). Mutual authentication is a desired characteristic in verification schemes that transmit sensitive data, in order to ensure data security. Mutual authentication can be accomplished with two types of credentials: usernames and passwords, and public key certificates.

Password strength

Password strength is a measure of the effectiveness of a password against guessing or brute-force attacks. In its usual form, it estimates how many trials an attacker who does not have direct access to the password would need, on average, to guess it correctly. The strength of a password is a function of length, complexity, and unpredictability. Using strong passwords lowers the overall risk of a security breach, but strong passwords do not replace the need for other effective security controls.

Related lectures (64)

Authentication: Passwords

Covers the importance of passwords in authentication, including secure transfer, storage, and checking techniques.

Access Control Policies: Authentication and Authorization

Explores access control policies, authentication methods, and the principles of least privilege, emphasizing the importance of secure and user-friendly authentication protocols.

Access Control: Password-based Cryptography

Explores access control and password-based cryptography, including challenges, biometrics, and the biometric passport case study.

Password Security

Emphasizes the importance of safeguarding passwords and avoiding sharing them.