Password protection using chain of random hashing functions
An approach is provided that uses multiple hashing algorithms to verify a password. The approach receives a password that corresponds to a user identifier. A set of hashing algorithms are retrieved with the retrieved set based on the received user identifier so that different user identifiers utilize different sets of hashing algorithms. Hashing the password using each of the hashing algorithms included in the set of algorithms with the hashing resulting in a hash result. An expected hash result that corresponds to the user identifier is retrieved and the approach then verifies the received password by comparing the hash result to the first expected hash result.
1. A method, implemented by an information handling system comprising a processor, a memory accessible by the processor, and a network interface connecting the information handling system to a computer network, the method comprising:
receiving a first password, wherein the first password corresponds to a first user identifier from a plurality of user identifiers that also includes a second user identifier;
retrieving a first plurality of hashing algorithms based on the received first user identifier, wherein the second user identifier corresponds to a second plurality of hashing algorithms that are different than the first plurality of hashing algorithms;
hashing the first password using each of the first plurality of hashing algorithms, the hashing resulting in a first hash result;
retrieving a first expected hash result corresponding to the first user identifier; and
verifying the received first password by comparing the first hash result to the first expected hash result.
2. The method of claim 1 wherein the hashing further comprises:
first hashing the first password using a first hashing algorithm included in the first plurality of hashing algorithms, the first hashing resulting in a first hash result; and
second hashing the first hash result using a second hashing algorithm included in the first plurality of hashing algorithms, the second hashing resulting in a second hash result.
3. The method of claim 1 wherein the first plurality of hashing algorithms has a first order in which the first plurality of hashing algorithms are executed.
4. The method of claim 3 wherein the first user identifier is included in a plurality of user identifiers that also includes a second user identifier, wherein the second user identifier corresponds to a second order in which a second plurality of hashing algorithms are executed when processing a second password that corresponds to the second user identifier, wherein the second order is different than the first order.
5. The method of claim 1 further comprising:
receiving a new user identifier and a new password that corresponds to the new user identifier;
pseudo-randomly selecting a first hashing algorithm from a plurality of available hashing algorithms;
executing the selected first hashing algorithm against the new password resulting in a first hash result;
generating an expected hash result that corresponds to the new password by repeatedly pseudo-randomly selecting one or more additional hashing algorithms, each of which is executed against a preceding hash result; and
retaining the expected hash result in a nonvolatile data store.
6. The method of claim 5 further comprising:
retaining the first hashing algorithm and the one or more additional hashing algorithms used to generate the expected hash result.
7. An information handling system comprising:
one or more processors;
a memory coupled to at least one of the processors;
a network interface that connects the information handling system to a computer network; and
a set of computer program instructions stored in the memory and executed by at least one of the processors in order to perform actions comprising:
receiving a first password, wherein the first password corresponds to a first user identifier from a plurality of user identifiers that also includes a second user identifier;
retrieving a first plurality of hashing algorithms based on the received first user identifier, wherein the second user identifier corresponds to a second plurality of hashing algorithms that are different than the first plurality of hashing algorithms;
hashing the first password using each of the first plurality of hashing algorithms, the hashing resulting in a first hash result;
retrieving a first expected hash result corresponding to the first user identifier; and
verifying the received first password by comparing the first hash result to the first expected hash result.
8. The information handling system of claim 7 wherein the hashing further comprises:
first hashing the first password using a first hashing algorithm included in the first plurality of hashing algorithms, the first hashing resulting in a first hash result; and
second hashing the first hash result using a second hashing algorithm included in the first plurality of hashing algorithms, the second hashing resulting in a second hash result.
9. The information handling system of claim 7 wherein the first plurality of hashing algorithms has a first order in which the first plurality of hashing algorithms are executed.
10. The information handling system of claim 9 wherein the first user identifier is included in a plurality of user identifiers that also includes a second user identifier, wherein the second user identifier corresponds to a second order in which a second plurality of hashing algorithms are executed when processing a second password that corresponds to the second user identifier, wherein the second order is different than the first order.
11. The information handling system of claim 7 wherein the actions further comprise:
receiving a new user identifier and a new password that corresponds to the new user identifier;
pseudo-randomly selecting a first hashing algorithm from a plurality of available hashing algorithms;
executing the selected first hashing algorithm against the new password resulting in a first hash result;
generating an expected hash result that corresponds to the new password by repeatedly pseudo-randomly selecting one or more additional hashing algorithms, each of which is executed against a preceding hash result; and
retaining the expected hash result in a nonvolatile data store.
12. The information handling system of claim 11 wherein the actions further comprise:
retaining the first hashing algorithm and the one or more additional hashing algorithms used to generate the expected hash result.
13. A computer program product comprising:
a computer readable storage medium, comprising computer program code that, when executed by an information handling system, executes actions comprising:
receiving a first password, wherein the first password corresponds to a first user identifier from a plurality of user identifiers that also includes a second user identifier;
retrieving a first plurality of hashing algorithms based on the received first user identifier, wherein the second user identifier corresponds to a second plurality of hashing algorithms that are different than the first plurality of hashing algorithms;
hashing the first password using each of the first plurality of hashing algorithms, the hashing resulting in a first hash result;
retrieving a first expected hash result corresponding to the first user identifier; and
verifying the received first password by comparing the first hash result to the first expected hash result.
14. The computer program product of claim 13 wherein the hashing further comprises:
first hashing the first password using a first hashing algorithm included in the first plurality of hashing algorithms, the first hashing resulting in a first hash result; and
second hashing the first hash result using a second hashing algorithm included in the first plurality of hashing algorithms, the second hashing resulting in a second hash result.
15. The computer program product of claim 13 wherein the first plurality of hashing algorithms has a first order in which the first plurality of hashing algorithms are executed.
16. The computer program product of claim 15 wherein the first user identifier is included in a plurality of user identifiers that also includes a second user identifier, wherein the second user identifier corresponds to a second order in which a second plurality of hashing algorithms are executed when processing a second password that corresponds to the second user identifier, wherein the second order is different than the first order.
17. The computer program product of claim 13 wherein the actions further comprise:
receiving a new user identifier and a new password that corresponds to the new user identifier;
pseudo-randomly selecting a first hashing algorithm from a plurality of available hashing algorithms;
executing the selected first hashing algorithm against the new password resulting in a first hash result;
generating an expected hash result that corresponds to the new password by repeatedly pseudo-randomly selecting one or more additional hashing algorithms, each of which is executed against a preceding hash result;
retaining the expected hash result in a nonvolatile data store; and
retaining the first hashing algorithm and the one or more additional hashing algorithms used to generate the expected hash result.