Post Reply 
 
Thread Rating:
  • 0 Votes - 0 Average
  • 1
  • 2
  • 3
  • 4
  • 5
Use bcrypt with suitable work factor for passwords if it's available
05-24-2012, 12:56 PM
Post: #1
Use bcrypt with suitable work factor for passwords if it's available
It looks like the password hashing in webERP is a bit weaker than it could be. bcrypt is more resistant to brute force and features a configurable "work factor" that allows it to keep up with advances in computer hardware.

CRYPT_BLOWFISH - Blowfish hashing with a salt as follows: "$2a$", a two digit cost parameter, "$", and 22 digits from the alphabet "./0-9A-Za-z". Using characters outside of this range in the salt will cause crypt() to return a zero-length string. The two digit cost parameter is the base-2 logarithm of the iteration count for the underlying Blowfish-based hashing algorithmeter and must be in range 04-31, values outside this range will cause crypt() to fail.

http://php.net/manual/en/function.crypt.php

The crypt function already uses hash ID values to clearly identify which hash is being used, and it's a simple matter to fall back to a supported hash on systems old enough to lack CRYPT_BLOWFISH so this could be implemented in a backwards compatible manner.
Find all posts by this user
Quote this message in a reply
Post Reply 


Forum Jump:


User(s) browsing this thread: 1 Guest(s)