How to protect against password attacks without forwarding?

Question

I was wondering if it was common practice to solo and hash a password like

E (addition \ hash (salt || password))

where || is concatenation, and E uses RSA, for example. First of all, I ask this question for transporting the password database (not in the online storage, where the server will have a private key to decrypt the encrypted password at any time).

I know that the cryptographic hash must be irreversible, but a strong off-line attack with weak passwords will easily reveal the password. To ultimately decrypt the record in this database, the server will know the fill length and simply cancel the registration to show the hash (salt password).

This is not a typical problem, but I could not find a link to someone who should correctly transfer the password database and protect themselves from an offline attack .

Answer 1

Encrypt the password file with something strong, then it doesn’t matter how the passwords are stored inside the file.

Those. use something like PGP for transport.

I noticed that this answer was suspended once before someone supported it, and just thought that I would clarify this, since I suspect that the person who rejected my answer did not actually read the question. On the other hand, it is possible that full encryption of the entire file is not possible for the person asking the question. This would be a convenient clarification on the issue, if so.

, , (). , - .

, - , , .

, , , , , .

, (PGP, GPG ..), - , , , .

Answer 2

• , .
• .

. , .

Answer 3

, , , . - , . , , - .

Answer 4

bruteforce . bcrypt PBKDF2 - , . , , .

, .

CodingHorror : http://www.codinghorror.com/blog/2012/04/speed-hashing.html

Answer 5

, :

.

This is a sure way to turn off brute force attacks. Harder to hit a moving target.

Answer 6

If you control a function that is trying to decrypt a database, set a timer for 1 second between attempts?

which will undoubtedly slow down brute force