arturobernalg opened a new pull request, #549: URL: https://github.com/apache/jspwiki/pull/549
New passwords were always stored as PBKDF2-HMAC-SHA256 with a fixed iteration count. Two new properties set both, for the XML and the JDBC user databases: - jspwiki.credentials.hash.algorithm: PBKDF2-SHA256 (the default) or PBKDF2-SHA512. - - jspwiki.credentials.hash.iterations: 600000 by default for SHA-256 and 210000 for SHA-512, which follows the current OWASP guidance for each. An unsupported algorithm, or an iteration count that is not a positive number, is logged and replaced by the defaults (the iteration count is replaced too when the algorithm is, as it was meant for the other one). A count below the recommended one is accepted with a warning. Entries that are already stored keep verifying with whatever algorithm and iterations they were created with, since both are part of the entry. When a user logs in successfully and the stored entry does not have the configured algorithm and iterations, the password is hashed again with them. This already happened for the older SHA formats and now covers a change of settings too. The entries written by earlier releases have the same format, so nothing has to be migrated. Password reuse detection understands every supported algorithm. CryptoUtil gets the algorithm-aware methods (@since 3.0.1) and keeps the existing ones. The properties are documented in jspwiki.properties. Not part of this change: the command line of CryptoUtil still only produces the older SHA formats. Other algorithms (bcrypt, scrypt, Argon2) are not in the JDK and are not added. Tests: 10 new cases in CryptoUtilPbkdf2Test and 10 in XMLUserDatabaseTest (configured algorithm and iterations, defaults, hashing again after a change of algorithm or of iterations only, no change when the settings are the same, no change after a failed login, legacy entries, invalid settings, password reuse across algorithms). The jspwiki-util, jspwiki-event and jspwiki-main suites pass. The JDBC database shares the code; its existing tests pass but I did not add new ones for the new properties. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
