Password storage and login security

Choosing Argon2id settles how each record is hashed and leaves most of a login system still to design. NIST SP 800-63B-4 asks for passwords of at least 15 characters when they are the only factor, a blocklistblocklist (of passwords): A list of values a new password may not take: passwords from breach corpora, common and dictionary words, and words of the context such as the service's name and the user name, as NIST SP 800-63B-4 asks. of compromised values and at most 100 consecutive failed attempts on an account; OWASP asks for a hash that takes less than a second on your own servers and grows stronger as they do.

This lesson builds the rest around the hash: tuning its cost on your hardware and raising it at login, a pepper that a stolen database does not contain, the NIST rules for length, Unicode and blocklists, breached-password checks that never send the password, and limits on online guessing.

A login system is six decisions around the password hash

Password storage covers the first three decisions below, what a stolen table holds; login security covers the other three, what each request may try. Each has a short answer, and the sections that follow build each one in code:

• Cost: measure the hash on the hardware that runs it, and keep a check well under a second.
• Upgrades: rehashrehash on login: Rewriting a password record with the current settings right after its owner signs in successfully, the one moment the server holds the verified password. a record made under older settings right after a successful login, the one moment the server holds the password.
• Pepper: a secret key kept outside the database and mixed into every hash, for example as Argon2’s secret input, so that a stolen table alone cannot be checked against guesses.
• Policy: length in code points after Unicode normalisation, long passwords allowed, a blocklist of breached, common and context words such as the service’s name, and no rules on kinds of characters.
• Breach checks: compare a new password with breach data through a range query that sends only five characters of its hash.
• Online guessing: limits per account, with growing waits rather than quick lockouts, checked before the slow hash runs.

Step through the order in which one login meets them:

Normalising comes first for a reason the program shows. The same password typed on a laptop and on a phone can arrive as different code points: é as one character, or as e followed by a combining accent. NIST SP 800-63B-4 asks verifiers to apply Unicode normalisation, form NFC, before hashing:

"""Two passwords that look identical, typed on two devices: "café" with é as one code point, and with e followed by a
combining accent. Their bytes differ, so their hashes differ, until both are normalised to NFC before hashing."""
import hashlib
import unicodedata

typed_on_laptop = "café-monsoon-42"  # é as one code point, U+00E9
typed_on_phone = "café-monsoon-42"  # e, then U+0301 COMBINING ACUTE ACCENT

for label, p in [("laptop", typed_on_laptop), ("phone", typed_on_phone)]:
    print(f"{label:<6} {p}  {len(p)} code points, {len(p.encode())} bytes, SHA-256 {hashlib.sha256(p.encode()).hexdigest()[:12]}…")
print(f"same text on screen, same bytes: {typed_on_laptop.encode() == typed_on_phone.encode()}")

nfc = [unicodedata.normalize("NFC", p) for p in (typed_on_laptop, typed_on_phone)]
print(f"after NFC: {len(nfc[0])} and {len(nfc[1])} code points, same bytes: {nfc[0].encode() == nfc[1].encode()}")

laptop café-monsoon-42  15 code points, 16 bytes, SHA-256 f992130d869d…
phone  café-monsoon-42  16 code points, 17 bytes, SHA-256 a1a348f41ec9…
same text on screen, same bytes: False
after NFC: 15 and 15 code points, same bytes: True

The two strings look the same but have 15 and 16 code points and different hashes, so without NFC the person signs up on one device and is told their password is wrong on the other. After NFC both have 15 code points and the same bytes. Small as it is, the case shows why password storage and login security are designed together: the stored hash is only as consistent as the steps in front of it.

Tuning the cost on the servers that will run it Pro: opens with a Pro, Premium or Ultimate pass