Question about Servoy security

Classic Servoy
1

Hi,

I’m new to servoy, and have trawled the forums looking for an answer to the following question. I saw from this post (http://forum.servoy.com/viewtopic.php?f=5&t=12472) that Servoy stores passwords using a one-way, irreversible hash. Is the hash algorithm a known, standard published one, such as the salted password approaches used on Unix/Linux?

I am contemplating using an external authentication scheme, but want to be able to migrate existing users and passwords to the external system. Therefore, I need to be able to carry the existing password encryption scheme with me (just one among several options).

Much thanks in advance.

2

this is the code that creates the hash of the passwords:

public static String calculateMD5HashBase64(String password)
	{
		String result = null;
		try
		{
			MessageDigest md = MessageDigest.getInstance("MD5"); //$NON-NLS-1$
			byte[] hash = md.digest(password.getBytes("UTF-8")); //$NON-NLS-1$
			result = encodeBASE64(hash).trim();
		}
		catch (Exception e)
		{
			Debug.error(e);
		}
		return result;
	}

so it is MD5 and then base64 encoded.

3

Excellent! Much thanks!

4

Any reason you have chosen not to salt the hash?

It’s common practice to store password hashes with something like… hash = md5 ( ( password + salt ) + salt )

5

Any update to how this is done? plain MD5 without a salt has long been considered broken for password hashing.

http://www.kb.cert.org/vuls/id/836068
http://en.wikipedia.org/wiki/Rainbow_table
http://www.freerainbowtables.com/

6

we can’t just change it… That would break all existing solutions that uses existing users/password combinations.

Please create a case for this if you want to use MD5+salt or SHA, i guess this must then be a system setting somewhere where you can switch…

7

I noticed revs 5807 & 5823 in the trunk, and from the commit message and corresponding code they seem to address the issue of storing passwords as MD5 hashes. The reference a ticket (SVY-319) that is not publicly accessible, so can you confirm that this will be upcoming in servoy 6.1?

https://www.servoyforge.net/projects/se … sions/5807
https://www.servoyforge.net/projects/se … sions/5823

8

yes from now on new passwords will be stored by a different hashing algo: http://en.wikipedia.org/wiki/PBKDF2

9

Johan,

doesn’t this break existing solutions as you mentioned in in this topic before?

10

no because we store in the database which kind it is
so by default we expect the old MD5
but if we see a new entry (having a specific prefix) we know it is the new way.
And all new passwords (when you create a new user/pw or update an existing pw) the new way is used and the hash has the new prefix