Actions

Difference between revisions of "Developer Area/Specifications in Development/Improve Password Storage"

From Mahara Wiki

< Developer Area‎ | Specifications in Development
(Created page with "This is a brief overview on how to improve the password storage in Mahara. This is only for user passwords stored in the usr table. Currently, these passwords are stored as a s…")
 
Line 12: Line 12:
 
The layout this page suggests is:
 
The layout this page suggests is:
  
- On login, check whether it is using the new hash technique, if so use that
+
* On login, check whether it is using the new hash technique, if so use that
-- Otherwise, use the old technique and if successful change the password to use the new technique (user doesn't need any input except for initial password to log in, and maybe a small pause). Next time they can use the old technique.
+
** Otherwise, use the old technique and if successful change the password to use the new technique (user doesn't need any input except for initial password to log in, and maybe a small pause). Next time they can use the old technique.
  
 
A note about bulk uploads:
 
A note about bulk uploads:
  
 
When uploading a CSV to create users, we don't really want to spend a large amount of time hashing passwords. Because of this I would suggest using the old technique of sha1($salt . $password) for this bulk upload of users.
 
When uploading a CSV to create users, we don't really want to spend a large amount of time hashing passwords. Because of this I would suggest using the old technique of sha1($salt . $password) for this bulk upload of users.

Revision as of 15:23, 14 November 2011

This is a brief overview on how to improve the password storage in Mahara.

This is only for user passwords stored in the usr table.

Currently, these passwords are stored as a sha1 of the salt concatenated with the password (PHP sha1($salt . $password)). The salt is generated as $salt = substr(md5(rand(1000000, 9999999)), 2, 8);

A suggestion was made to improve the storage of these passwords by using a stronger algorithm. See https://bugs.launchpad.net/mahara/+bug/843568

The algorithm in question is bcrypt or CRYPT_BLOWFISH (available on PHP 5.3+, and below if it is available on the OS level).

The layout this page suggests is:

  • On login, check whether it is using the new hash technique, if so use that
    • Otherwise, use the old technique and if successful change the password to use the new technique (user doesn't need any input except for initial password to log in, and maybe a small pause). Next time they can use the old technique.

A note about bulk uploads:

When uploading a CSV to create users, we don't really want to spend a large amount of time hashing passwords. Because of this I would suggest using the old technique of sha1($salt . $password) for this bulk upload of users.