0

The goal:

  • Store usernames, hash salt & hashed password in a text file
  • Allow user to copy and paste the file to other computers that are running the same application
  • Catch if a user edits the text file and replaces the hashed password, effectively resetting a password to whatever they want, for any user.

The problem: If I store usernames, hash salt & hashed password a user can reset the password assuming they know the hashing algorithm. I could add an extra step, like hash(password, salt, "X") where "X" is just a constant value getting added to the password and salt. This value "X" could be hardcoded into the application. However, this is security through obscurity, which is "fine" until this "custom" hashing algorithm is figured out / exposed.

Is there a way to accomplish these goals even if the users knew the hashing algorithms being used?

It sounds like a use case for a private key that must be kept secret, but are there other options?

This was a great Q&A but it doesn't have a solution for moving files: How to securely save username/password (local)?

JasonC
  • 139
  • 8

1 Answers1

2

I would look into digitally signing the file.

Wiki on Digital Signing

If you have access to something like AES crypto suite it would be fairly easy to generate a privKey/pubKey pair and sign your password file to ensure it is not tampered with, you would of course need to resign the file anytime legitimate changes are made to it.

I should mention using the private key to sign inside the application means the key to a certain extent is vulnerable to being extracted by users. You need to decide for yourself how secure your system needs to be.

Erik Kinstler
  • 76
  • 9
  • This is really not useful suggestion as signing client side is of no difference than not signing at all (as a way to prevent re-generation of file locally). Signing server side need a lot of thinking how to do safely and sensible. – Alexei Levenkov Nov 16 '22 at 21:56
  • 1
    @AlexeiLevenkov what do you mean no difference? Without signing - no way of telling if the user tampered with the file. With signing - you can tell if the user tampered with the file, unless they extracted the private key. – JasonC Nov 16 '22 at 22:05
  • Who are you trying to protect against here? If the attacker has the skills to modify your application, there's nothing you can do to protect it. You're basically saying "Here is the key and here is the encrypted data, and here is the program that can decrypt it, but please only use it how I want you to, thanks" – Jeremy Lakeman Nov 17 '22 at 00:50
  • @JeremyLakeman - The attacker shouldn't be able to modify the application. This sounds like the problem will then be how to secure a private key in an application and have that private key be the same for all installs of the application on different machines. – JasonC Nov 17 '22 at 19:45