How do you balance performance and security when hashing and salting passwords?

For example: Siva registers on a website with "Siva2*!n" as his password. Instead of storing it as plaintext, a hash like "a9c8f1d29a1e36" is stored, protecting it from direct access. However, attackers can still crack hashes using methods like rainbow tables or brute-force attacks. To defend against this, salting is employed. A unique random value (salt) is created for each user, e.g., "XyZ12!", and added to the password, making "XyZ12!Siva2*!n", which is then hashed. The salted hash, along with the salt, is stored. Salting makes cracking passwords harder by forcing attackers to compute hashes for every possible salt value, taking more time and resources. Thus, hashing and salting together greatly enhance password security.

To understand..Now, let's assume that 1,000 users simultaneously attempt to log in. For each user, the system hashes the entered password and compares it to the stored hash. Given the 10 ms hashing time for each password, the system would take about 10 seconds to authenticate all 1,000 users. However, if the platform switches to a more secure but computationally expensive hashing algorithm like bcrypt, the hashing time might increase to 100 ms per hash. In this scenario, it would take the system 100 seconds to authenticate the same 1,000 users, potentially affecting the user experience due to increased wait times. This example illustrates the importance of balancing security and performance when selecting a hashing algorithm.

Storage space is cheap, and processing power is increasing exponentially (more or less) according to Moore’s Law. An ounce of prevention by strong encryption will be much better than the pound of cure if an attacker breaks your weak encryption. Remember, Moore’s Law benefits the attackers as well! As your ability to use strong encryption increases, so does their ability to break it.

the impact of salting on performance is very small, especially when weighed against the significant security benefits it provides in preventing attacks like rainbow table attacks. The increase in processing and storage requirements is typically considered negligible and well worth the trade-off for enhanced security.

I don't agree with a lot of the prevailing 'common sense' about this balance. The unfortunate reality is that systems often only get updated every five to seven years. This means that you're designing and building a system that needs to be able to resist the attacks we cannot predict now. Skimping on hashing and salting complexity is the very last place to add risk. Adding computing power is far cheaper than tens of millions of dollars in brand damage. Save money elsewhere.

The balance between need to secure and need for applications to be responsive and performant is a fine balancing act. It’s dependent on use cases and nature of business and process served by the application. High sensitive processes for banking, defense, etc need to lean more on security, Vs others do not.

Implementing hashing Generally involves the following Select a Hashing Algorithm Generate a Unique Salt: Concatenate Password and Salt Hash the Combination Store Hash and Salt Verify Passwords. Whether we use a library or implement it manually it involves the same steps. it's recommended to use Libraries because they handle all the difficult work for you.