[
https://issues.apache.org/jira/browse/JSPWIKI-1231?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18135869#comment-18135869
]
Arturo Bernal commented on JSPWIKI-1231:
----------------------------------------
A pull request is open: https://github.com/apache/jspwiki/pull/549. Two new
properties set the algorithm and the iterations of the hash of new passwords,
for the XML and the JDBC user databases: jspwiki.credentials.hash.algorithm
(PBKDF2-SHA256, the default, or PBKDF2-SHA512) and
jspwiki.credentials.hash.iterations (600000 for SHA-256 and 210000 for SHA-512
by default). An unsupported value is logged and replaced by the defaults.
Entries that are already stored keep verifying with the algorithm and the
iterations they were created with, and are hashed again when the user logs in
and the settings differ. The tests of the user databases and of CryptoUtil in
the pull request pass on its branch and do not pass on master.
> UserDatabase password storage mechanism should be adjustable and not fixed on
> SHA-256
> -------------------------------------------------------------------------------------
>
> Key: JSPWIKI-1231
> URL: https://issues.apache.org/jira/browse/JSPWIKI-1231
> Project: JSPWiki
> Issue Type: Improvement
> Reporter: Alex O'Ree
> Priority: Major
> Labels: pull-request-available
>
> There's stronger hashing available now and we should not be fixed in time to
> a specific hash algorithm. let's make it adjustable if possible or at least
> provide stronger options
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
