> On 12 Jan 2024, at 11:21, John Thurston <john.thurs...@alaska.gov> wrote: > > Excellent, thank you very much, William! > But know that I've read that, I think I'll want to start with the > underscore-implementation. That should result in ldifs from my DS 2.1 which I > could, if needed, use with my DS 1.4 instance. This isn't a long-term > setting, just a migration step until we turn off 1.4.
That's fine - it's what the "upgrade on bind" feature is for. Once you finish your migration, you change the default pw scheme in dse.ldif and then on bind it transparently upgrades the hash format. > At that time, we'll step 2.1 up to SHA512 and duck the whole -/_ thing. You should use PBKDF2-SHA256 here, not SHA512. Big number != more securerer. The benefit of PBKDF2 is that it many rounds which forces an attacker to do a lot of work. SHA256 is a secure hash here, so you dont practically gain anything by choosing PBKDF2-SHA512 over PBKDF2-SHA256 - they both will end up targeting and achieving the same work factor. Worst case you actually end up less secure if you have a CPU that *doesn't* have hardware accelerated SHA512. This will force fewer rounds as a result, where SHA256 could achieve more rounds because your CPU has hwaccel for the algo. NIST still recommend PBKDF2-SHA256 here as well. If you don't have FIPS requirements, consider argon2 instead as it's memory hard as well as cpu hard. -- Sincerely, William Brown Senior Software Engineer, Identity and Access Management SUSE Labs, Australia -- _______________________________________________ 389-users mailing list -- 389-users@lists.fedoraproject.org To unsubscribe send an email to 389-users-le...@lists.fedoraproject.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/389-users@lists.fedoraproject.org Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
