JavaScript Implementation of a Multi-Factor Credential Hashing Function (MFCHF)
npm install mfchf
Multi-Factor Credential Hashing Function







Site |
Docs |
Contributing |
Security |
Multifactor |
Paper |
Author
Since the introduction of bcrypt in 1999, adaptive password hashing functions, whereby brute-force resistance increases symmetrically with computational difficulty for legitimate users, have been our most powerful post-breach countermeasure against credential disclosure. Unfortunately, the relatively low tolerance of users to added latency places an upper bound on the deployment of this technique in most applications. In this paper, we present a multi-factor credential hashing function (MFCHF) that incorporates the additional entropy of multi-factor authentication into password hashes to provide asymmetric resistance to brute-force attacks. MFCHF provides full backward compatibility with existing authentication software (e.g., Google Authenticator) and hardware (e.g., YubiKeys), with support for common usability features like factor recovery. The result is a 10 6 to 10 48 times increase in the difficulty of cracking hashed credentials, with little added latency or usability impact.
mfchf.js to your project: self-hosted, using a CDN, or using NPM (recommended).
mfchf.js or mfchf.min.js to your page like so:
mfchf.min.js in your page like so:
// Setup MFCHF-HOTP6 hash
const { hash, secret } = await mfchf.hotp6.setup('password123')
// Verify MFCHF-HOTP6 hash
const otp = parseInt(hotp({ secret, counter: 1 }))
const result = await mfchf.hotp6.verify(hash, 'password123', otp)
result.valid.should.be.true
`
$3
`
// Setup MFCHF-TOTP6 hash
const { hash, secret } = await mfchf.totp6.setup('password123')
// Verify MFCHF-TOTP6 hash
const otp = parseInt(speakeasy.totp({ secret }))
const result = await mfchf.totp6.verify(hash, 'password123', otp)
result.valid.should.be.true
``