** Description changed:
[ Impact ]
Add configurable rounds for pw-pbkdf2.so module
Without the ability to configure the iteration count, it is not possible
to meet current security best practices or achieve compliance with FIPS
140-3, which requires configurable and sufficiently high iteration
counts for PBKDF2.
[ Test Plan ]
* install slapd and slapd-contrib
- * before update: only supports hardcoded 10000 rounds:
- slappasswd -o module-load=pw-pbkdf2.so -h {PBKDF2-SHA512}
- -> observe {PBKDF2-SHA512}10000$...
- * after update, any round number can be configured:
- slappasswd -o module-load="pw-pbkdf2.so 1337" -h {PBKDF2-SHA512}
- -> observe {PBKDF2-SHA512}1337$...
+ * new autopkgtest d/t/pbkdf2-contrib should pass:
+ * before update: only supports hardcoded 10000 rounds:
+ slappasswd -o module-load=pw-pbkdf2.so -h {PBKDF2-SHA512}
+ -> observe {PBKDF2-SHA512}10000$...
+ * after update, any round number can be configured:
+ slappasswd -o module-load="pw-pbkdf2.so 1337" -h {PBKDF2-SHA512}
+ -> observe {PBKDF2-SHA512}1337$...
[ Where problems could occur ]
* pbkdf2 password validation/hashing could get a regression
* Due to the configurable number amount, old passwords could become invalid
due do different round counts
[ Original Report ]
On Ubuntu 24.04, the OpenLDAP package ships with the library
/usr/lib/ldap/pw-pbkdf2.so.
While this module works for generating PBKDF2-SHA512 password hashes, it does
not provide an option to configure the number of iterations.
For example:
slappasswd -o module-load=pw-pbkdf2.so -h {PBKDF2-SHA512}
generates a hash with a fixed iteration count (e.g. 10000) and does not
accept parameters to increase it.
In contrast, the upstream contrib module passwd/pbkdf2 on
https://git.openldap.org/openldap/openldap/-/tree/master/contrib/slapd-
modules/passwd/pbkdf2
supports the iteration count option and allows administrators to
configure it.
moduleload pw-pbkdf2.so [iterations]
Steps to reproduce:
Install OpenLDAP on Ubuntu 24.04. (slapd and slapd-contrib pakages)
Run
slappasswd -o module-load=pw-pbkdf2.la -h {PBKDF2} -s secret
{PBKDF2}10000$ZvU8GRSybbefW48n8BeyuA$XE1t4W09ZP0z8zmLVb/SbwaOl2Y
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2125685
Title:
pbkdf2 needs configurable hashing rounds for FIPS 140-3
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/openldap/+bug/2125685/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
