Re: Using OSCommerce Encrypted Password in OfBiz

[David E Jones]

-David


On Nov 1, 2007, at 12:08 PM, Vince M. Clark wrote:

This trick is that in OFBiz we haven't decided on a salt string for the entire server (or per database) or a salt string per record. Per server is probably adequate, IMO, and then it would just sit in a config file. Either way it hasn't been coded up (that I'm aware of anyway) so you'd have to make a small code change, should be pretty trivial though (like an hour to implement and test the whole thing, including the config file).

pw has a : with two more characters. So it is salted.



Vince Clark
Global Era
The Freedom of Open Source
[EMAIL PROTECTED]
(303) 493-6723

----- Original Message -----
From: "Jonathon -- Improov" <[EMAIL PROTECTED]>
To: user@ofbiz.apache.org
Sent: Thursday, November 1, 2007 9:58:00 AM (GMT-0700) America/Denver
Subject: Re: Using OSCommerce Encrypted Password in OfBiz

Check the length of the password hash in osCommerce. It could be 35
characters, 2 characters longer than MD5's 32 (with a ":" in between).

Next, look into osCommerce password-generating codes. I believe
osCommerce password hashes are salted.


dictionary attack.

(Note that the salt has to be added BEFORE the MD5 hashing, or you'll
end up with <normal_MD5_hash><some_silly_extra_salt_in_plain_view>. In
that case, you can just chop off the appended unmixed salt and do a
dictionary attack. I don't think the osCommerce salting is that silly.
So, remember the simple cooking rule. Salt to taste, and mix well!)

If you have tons of money and loads of clustered computers, you could
attempt to undo those salted hashes. Or... if you have a quantum
computer... who knows? :)

Jonathon

Jacques Le Roux wrote:

Is it possible to use the same salt in OfBiz as was used in osCommerce? Is it as simple as bring over a key or is there code to write? There's no way you can easily reverse-engineer those salted hashes into plain MD5 hashes. That's the whole point of salting! To prevent an easy

AFAIK MD5 is MD5 (but I'm far from being an ecnryption guru ;o). Perhaps OScommerce MD5 is salted (or the peculiar data that you

import) ? (OFBIz's MD5 is not yet salted, should be - soon? - though)

Jacques

----- Message d'origine -----
De : "Vince M. Clark" <[EMAIL PROTECTED]>
À : "user" <user@ofbiz.apache.org>
Envoyé : jeudi 1 novembre 2007 14:57
Objet : Fwd: Using OSCommerce Encrypted Password in OfBiz

Originally posted on dev.

Follow up question to Joel's original post. Do any of you security or encryption gurus out there know if pw's encrypted using MD5

in osCommerce should "automagically" work using MD5 encryption in OfBiz?

We imported the encrypted pw and switched security.properties to use MD5 instead of SHA. The pw's do not work.

Vince Clark
Global Era
The Freedom of Open Source
[EMAIL PROTECTED]
(303) 493-6723

----- Forwarded Message -----
From: "Jacques Le Roux" <[EMAIL PROTECTED]>
To: [EMAIL PROTECTED]

Subject: Re: Using OSCommerce Encrypted Password in OfBiz

Please use user ML for such questions 
http://docs.ofbiz.org/display/OFBADMIN/Mailing+Lists



Jacques

De : "Joel Blouin" <[EMAIL PROTECTED]>

Sent: Thursday, November 1, 2007 12:46:42 AM (GMT-0700) America/ Chihuahua Check password.encrypt.hash.type in security.properties, it's SHA by default

We have over 60000 customers in OSCommerce that we imported into OfBiz along with their existing MD5 encrypted passwords, so they can login with their current password. The import was the easy part. We configured OfBiz to use the same salt and MD5 encryption as OSCommerce, but the passwords do not work. What did we miss? Any guidance on this is greatly appreciated.

Thanks,

Joel

smime.p7s
Description: S/MIME cryptographic signature