1

Would it be beneficial to create a cryptographic hash function for more security. A cryptographic hash function is pretty much a pseudorandom string generating algorithm and it can easily be made difficult to break by increasing the number of possible hashes that can be generated.

Why make another cryptographic hash function

I want to hash passwords in a database such that the attacker cannot find their original value. I could use pepper and/or salts while generating the hashes but I wanna make it more secure. When I would make a proprietary hash function that is not available to the common public, how would the attacker even generate rainbow tables for the passwords.

1 Answers1

2

While you can create your own hash function, symmetric cipher, public key encryption scheme, etc. such that no one would know its design, it is probably a bad idea to rely on obscurity (as @kelalaka commented) to obtain security.

In the 19th century, Auguste Kerckhoffs stated a principle we call as "Kerckhoffs's principle":

a cryptosystem should be secure even if everything about the system, except the key, is public knowledge.

Additionally, Shannon's Maxim was also formulated in the 20th century and it states that:

one ought to design systems under the assumption that the enemy will immediately gain full familiarity with them

Or in other words - when you design a system for security, you must assume that the attacker knows how the system operates.

In your example of a proprietary hash function, the attacker might somehow get access to the software or hardware that computes such a hash function, and using crypto-analysis or backwards engineering it will manage to find vulnerabilities such as collision attacks or pre-image recovery techniques.

Another reason not to rely on proprietary or secret techniques is consumer trust: Why would a consumers trust that you keep their (hashed) password secure if you admit that the security comes from not knowing the implementation?

This is why in industry, the cryptographic primitives (hash functions, ciphers, signature schemes, etc.) are often only adopted after significant scrutiny from the scientific community. Then, RFCs and standards are being drafted so that vendors and service providers can quantify their security by saying which standard they comply to.

yacovm
  • 209
  • 1
  • 11