In-Portal Issue Tracker

Welcome to the In-Portal Open Source CMS Issue Tracker! This is a central management / tracking tool for all types of tasks / issues / bugs for the In-Portal Project. Before reporting any issues, please make sure to read the Guide into Issue Tracker and How to Properly Test and Report Bugs!
Main | My View | View Issues | Change Log | Roadmap | Docs | Wiki | Repositories
  

View Revisions: Issue #1362 [ All Revisions ] [ Back to Issue ]
Summary 0001362: Use even more secure password hashing algorithm
Revision 2012-10-18 10:22:16 by alex
Description I recommend doing 2 things:

* use adaptive hashing algorithm to hash user's password
* use random salt for each of hashed password (this will ensure different hash even if 2 users use same password for their accounts).


Here how I see it's implemented:

1. add following column to Users (PortalUser) database table after Password field:
- PasswordHashingMethod (1 - md5; 2 - md5+phppass; 3 - phppass)

2. during an upgrade we:
- apply "phppass" hashing over md5 password we have in db
- write down "md5+phppass" as currently used hashing logic

3. at user login (only password isn't hashed via "phppass") we:
- take plain-text password user submits in login form
- hash it using "phppass"
- update Password, PasswordHashingMethod columns of that user

4. at user login (every time) we:
- look at value in PasswordHashingMethod column to determine hashing algorithm
- generate hash using that algorithm and user provided plain-text password
- compare hash to one, that is selected based on Username/Email provided by user from login form

5. when checking password from SystemSettings table (e.g. on "root" user login) we:
- first checking using phppass hashing algorithm
- if that failed, then check using salted md5 algorithm
- if that succeeded, then convert stored password using phppass hashing algorithm and store it to database
Revision 2012-10-18 05:57:43 by alex
Description I recommend doing 2 things:

* use adaptive hashing algorithm to hash user's password
* use random salt for each of hashed password (this will ensure different hash even if 2 users use same password for their accounts).


Here how I see it's implemented:

[OK] 1. add following column to Users (PortalUser) database table after Password field:
- PasswordHashingMethod (1 - md5; 2 - md5+phppass; 3 - phppass)

2. during an upgrade we:
- generate random salts for each user
- apply "phppass" hashing over md5 password we have in db
- write down "md5+phppass" as currently used hashing logic

[OK] 3. at user login (only password isn't hashed via "phppass") we:
- take plain-text password user submits in login form
- hash it using "phppass"
- update Password, PasswordHashingMethod columns of that user

[OK] 4. at user login (every time) we:
- look at value in PasswordHashingMethod column to determine hashing algorithm
- generate hash using that algorithm and user provided plain-text password
- compare hash to one, that is selected based on Username/Email provided by user from login form

5. at login at "Installation Maintenance" step (during each upgrade) we:
- add new system setting called RootPasswordSalt (to accompany RootPassword setting), when it's missing
- read current salt and if it's missing then:
-- take "root" plain password (from login from submit)
-- generate random salt and put it into RootPasswordSalt setting
-- hash it using "phppass"
-- put new root password hash into RootPassword setting
Revision 2012-07-25 05:39:29 by alex
Description I recommend doing 2 things:

* use adaptive hashing algorithm to hash user's password
* use random salt for each of hashed password (this will ensure different hash even if 2 users use same password for their accounts).


Here how I see it's implemented:

1. add following column to Users (PortalUser) database table after Password field:
- PasswordSalt
- PasswordHashingMethod (1 - md5; 2 - md5+salt+bcrypt; 3 - salt+bcrypt)

2. during an upgrade we:
- generate random salts for each user
- apply "salt+bcrypt" hashing over md5 password we have in db
- write down "md5+salt+bcrypt" as currently used hashing logic

3. at user login (only password isn't hashed via "salt+bcrypt") we:
- take plain-text password user submits in login form
- hash it using "salt+bcrypt"
- update Password, PasswordHashingMethod columns of that user

4. at user login (every time) we:
- look at value in PasswordHashingMethod column to determine hashing algorithm
- generate hash using that algorithm and user provided plain-text password
- compare hash to one, that is selected based on Username/Email provided by user from login form

5. at login at "Installation Maintenance" step (during each upgrade) we:
- add new system setting called RootPasswordSalt (to accompany RootPassword setting), when it's missing
- read current salt and if it's missing then:
-- take "root" plain password (from login from submit)
-- generate random salt and put it into RootPasswordSalt setting
-- hash it using "salt+bcrypt"
-- put new root password hash into RootPassword setting

Main | My View | View Issues | Change Log | Roadmap | Docs | Wiki | Repositories
  

Web Development by Intechnic
In-Portal Open Source CMS
In-Portal Open Source CMS
Copyright © 2000 - 2009 MantisBT Group

Powered by Mantis Bugtracker