== Storing passwords

After a strong and secure password was created, it also has to be stored in a secure way.
The NIST gives recommendations on how applications should handle passwords and how to store them securely.

=== How should a password be stored?

- first of all: *use encryption and a protected channel for requesting passwords* +
  The verifier shall use approved encryption and an authenticated protected channel when requesting memorized secrets
  in order to provide resistance to eavesdropping and MitM (Man-in-the-middle) attacks.
- *resistant to offline attacks* +
  Passwords should be stored in a form that is resistant to offline attacks.
- *use salts* +
  Passwords should be salted before storing them.
  The salt shall have at least 32 bits in length and should be chosen arbitrarily so as to minimize salt value collisions among stored hashes.
- *use hashing* +
  Before storing a password it should be hashed with a one way key derivation function.
  The function takes the password, the salt and a cost factor as inputs and then generates a password hash. +
  Examples of suitable key derivation functions:
  * Password-based Key Derivation Function 2 (https://pages.nist.gov/800-63-3/sp800-63b.html#SP800-132[PBKDF2]) (as large as possible => at least 10.000 iterations)
  * https://pages.nist.gov/800-63-3/sp800-63b.html#SP800-132[BALLOON]
  * The key derivation function shall use an approved one-way function such as:
    ** Keyed Hash Message Authentication Code (https://pages.nist.gov/800-63-3/sp800-63b.html#FIPS198-1[HMAC])
    ** any approved hash function in https://pages.nist.gov/800-63-3/sp800-63b.html#SP800-107[SP 800-107]
    ** Secure Hash Algorithm 3 (https://pages.nist.gov/800-63-3/sp800-63b.html#FIPS202[SHA-3])
    ** https://pages.nist.gov/800-63-3/sp800-63b.html#SP800-38B[CMAC]
    ** Keccak Message Authentication Code (KMAC)
    ** Customizable SHAKE (cSHAKE)
    ** https://pages.nist.gov/800-63-3/sp800-63b.html#SP800-185[ParallelHash]
- *memory hard key derivation function* +
  Use memory hard key derivation functions to further increase the needed cost to perform attacks.
- *high cost factor* +
  The cost factor (iteration count) of the key derivation function should be as large as verification server performance will allow. (at least 10.000 iterations)