HaShuffle-Crafting Secure Passwords with a Splash of Shuffle Magic

With the advancement of technology comes comfort and risks. As new and powerful hardware comes into the market, data theft is increasing vastly. It makes it advantageous for attackers to decode sensitive information by brute forcing using pre-computed rainbow table hashes. Hashing is a technique that masks passwords using a complicated algorithm, which makes reversing a computed hash to be infeasible. Existing password security methods include hashing the password once using any hashing algorithm, hashing the passwords using two different or the same hashing algorithms, salting, using bcrypt, and scrypt, which are slow hashing algorithms that enhance security by intentionally using hardware resources and preventing rainbow table attacks to a certain extent. However, as technological advancement led to the development of powerful hardware that can perform billions of hash match calculations per second, users are vulnerable to their sensitive information being exposed such as passwords, usernames, email etc.,. An approach to this security vulnerability is HaShuffle, a multiple randomized hashing technique. When a user enters a password, several hashing algorithms such as sha256, sha384, sha224, sha512, sha1, md5, ripemd160 are chosen randomly for a certain number of iterations. The number of iterations is chosen randomly within a specified range. For each iteration, the resultant hash value of the previous iteration is taken as input again, and another randomly chosen hashing algorithm is used to hash the resultant input hash obtained in the previous step. Each algorithm is mapped to a unique number or symbol, which is appended to an empty string during each iteration process to generate the sequence string for the login phase and stored along with the hashed value in the database. Using this string sequence, the reentered password can be hashed using the same order of algorithms as it was hashed before by iterating over each character in this sequence string and hashing using the corresponding characters that are mapped to each hashing algorithm which ends up with the same hash value. This method of hashing multiple times using randomly chosen algorithms makes it infeasible for the attacker to perform a brute force attack to crack the password as the possible number of hash combinations for each password is computationally expensive and time-consuming. Thus, leading to improved security.