Hashing that ages gracefully.
PBKDF2 salted hashing to defeat dictionary and rainbow-table attacks — with the algorithm swappable, so your defenses keep pace as hardware does.
1. Why hashing, salting, and stretching
Passwords must never be stored recoverably; they are stored as one-way hashes, so a database breach does not hand over credentials. But a bare hash falls to precomputed rainbow tables, and a fast hash falls to brute force on modern GPUs. The defenses are a unique per-user salt (defeating precomputation) and a deliberately slow, iterated function (raising the cost of each guess).
// per-user salt + many iterations = expensive to brute-force
salt = csprng(16);
hash = PBKDF2(password, salt, iterations, keyLen);
store(salt, iterations, hash); // iterations recorded for future re-hash2. Crypto-agility: swap without pain
Today’s strong parameters are tomorrow’s weak ones, and PBKDF2 may give way to a memory-hard successor. Storing the algorithm and parameters with each hash lets the system verify old credentials and transparently upgrade them on next login — so the bar rises over time without a forced reset.
3. How B5 Secure handles it
B5 Secure uses salted PBKDF2 by default and makes the algorithm swappable, so credential storage stays strong as hardware and standards move. Hashing is one stage in a defense in depth that also blocks compromised credentials and rate-limits the paths attackers use to test them.