In High Sierra or Mojave, is it possible to harden our login password so that the hash is more difficult to crack? I'm not a crypto person, but can we increase the iterations, transforms, hashing algo strenth or something... to make the CPU work harder when using sudo and such? I know Debian/Ubuntu distros are capable of such hardening and keepass has a similar feature. Is it possible in macOS?

migrated from security.stackexchange.com Oct 21 '18 at 11:42

This question came from our site for information security professionals.

  • 1
    Longer passwords make them harder to crack. – schroeder Oct 21 '18 at 11:39
  • This is more of a MacOS config question than a security question. – schroeder Oct 21 '18 at 11:41
  • Is your intent to modify the operating system or just program your apps to salt and iterate more slowly? – bmike Oct 21 '18 at 21:29

On MacOS you can use PBKD2 (Password Based Key Derivation 2) to create secure password verifiers. This is an accepted method by NIST. Supply a random salt (you can save it with the hashed password) and an iteration count such the the derivation takes around 100ms.

When saving a password verifier just using a hash function is not sufficient and just adding a salt does little to improve the security. Instead iterate over an HMAC with a random salt for about a 100ms duration and save the salt with the hash. Better yet use a function such as PBKDF2, Rfc2898DeriveBytes, Argon2, password_hash, Bcrypt or similar functions. The point is to make the attacker spend substantial time finding passwords by brute force.

See NIST Digital Identity Guidelines

See this How to use CommonCrypto for PBKDF2 in Swift 2 & 3 or example code.

You must log in to answer this question.