[
https://issues.apache.org/jira/browse/KARAF-6925?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17239669#comment-17239669
]
ASF GitHub Bot commented on KARAF-6925:
---------------------------------------
coheigea opened a new pull request #1259:
URL: https://github.com/apache/karaf/pull/1259
Some points to note:
* In jaas/spring-security-crypto/pom.xml it just depends on a servicemix
bundle, I wasn't sure whether to just depend on the normal spring jar here.
* The feature I added could be reworked to remove dependency on a set
version of Spring.
* scrypt, bcrypt, pbkdf2 work well. For argon2, it is performing multiple
encryptions, not sure why this is yet.
* Remaining work: Update the default jaas file comments to show how to use
it, and update the documentation.
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
[email protected]
> Support stronger JAAS Encryption algorithms via spring-security-crypto
> ----------------------------------------------------------------------
>
> Key: KARAF-6925
> URL: https://issues.apache.org/jira/browse/KARAF-6925
> Project: Karaf
> Issue Type: Improvement
> Components: karaf
> Reporter: Colm O hEigeartaigh
> Assignee: Jean-Baptiste Onofré
> Priority: Major
> Labels: encryption
> Fix For: 4.2.11, 4.3.1
>
>
> Right now for JAAS password encryption, we only support basic digest
> algorithms, or else salted algorithms via the jasypt provider. However these
> are no longer considered secure, instead best practice is to use algorithms
> like scrypt, bcrypt, argon2, etc.
> The Spring Security Crypto project has password encoders for all of these
> algorithms, and has minimal dependencies, so we can leverage this to support
> a more modern encryption alternative.
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
