1. Executive Summary & Scope
Cryptographic Failures regarding credential storage occur when systems hash user passwords using outdated, fast hashing algorithms (MD5, SHA-1, SHA-256) or insufficient work factors. Fast hashes allow attackers possessing a database dump to compute billions of guesses per second using commercial GPU cracking rigs.
Standard Classification
OWASP Standard: OWASP Top 10 • Mapping: CWE-328 • Target Architecture: Public Web Systems & APIs
2. Threat Model & Attack Vectors
Adversaries compromise the backend database and recover plaintext user and administrator passwords within hours using rainbow tables and offline GPU dictionary attacks.
3. Code Analysis & Remediation Playbook
Vulnerable Implementation Pattern
// VULNERABLE: Fast, unsalted or unkeyed cryptographic hash
$password = $_POST['password'];
$hash = md5($password); // Insecure: millions of guesses per second
$stmt = $pdo->prepare("INSERT INTO users (email, password_hash) VALUES (?, ?)");
$stmt->execute([$email, $hash]);
Hardened Defense-in-Depth Implementation
// REMEDIATED: Argon2id with memory cost, time cost, and parallelism
$password = $_POST['password'];
// Enforce modern memory-hard Argon2id standard
$hash = password_hash($password, PASSWORD_ARGON2ID, [
'memory_cost' => 65536, // 64 MB
'time_cost' => 4, // 4 iterations
'threads' => 1 // 1 thread
]);
// Transparent migration check during user login
if (password_verify($password, $user['password_hash'])) {
if (password_needs_rehash($user['password_hash'], PASSWORD_ARGON2ID)) {
$newHash = password_hash($password, PASSWORD_ARGON2ID);
update_user_hash($user['id'], $newHash);
}
}
4. Audit Verification Checklist & Pass Criteria
| Verification Phase | Audit Test Description | Mandatory Passing Criteria |
|---|---|---|
| Database Hash Inspection | Extract sample hashes from test database to verify prefix patterns. | All active password hashes begin with `$argon2id$` or `$2y$12$`. Zero MD5/SHA hashes exist. |
| Timing Side-Channel Protection | Verify password comparison executes using constant-time string functions. | Verification prevents timing attacks regardless of input length. |
| Work Factor Benchmark | Measure hashing computation duration on production server hardware. | Hash generation takes between 250ms and 500ms to balance security and server throughput. |
Advertisement
WE
WebOTG Application Security Directorate
Senior Security Auditor
WebOTG provides benchmark reference documentation, automated matrix evaluators, and security test harnesses for government digital platforms, WQMS architectures, and STQC compliance frameworks.