Should Roundup replace current password hash with a new one.

Hi all:

I have been upgrading some of the password hashing infrastructure.
I could use your feedback.

A little background. By default Roundup uses the NIST standard PBKDF2
with SHA1. It has been the Roundup standard for many years.

Other previously supported hashes: crypt, D5, SHA (sha1). were
transparently upgraded to PBKDF2-SHA1 when a user logged in.

To make PBKDF2 resistant to password cracking, you can set a
work-factor which increases the number of rounds used when hashing the
stored password. For a long time that factor was 10000. Today that
factor isn't good enough. See:

   https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html#pbkdf2

for details.

The 2.3.0 release will increase it to 2,000,000 and admins will have to
make the change when they upgrade.

However PBKDF2 can be used with SHA512 rather than SHA1. The number of
rounds (work-factor) needed for that is less, but more computation is
required for SHA512 versus SHA1.

I have implemented PBKDF2-SHA512 as documented at
https://issues.roundup-tracker.org/issue2551253.

However I am not sure how to roll it into production. So I need your
help.

I can:

  1) deprecate PBKDF2-SHA1 and use PBKDF2-SHA512 as the default. This
     would be hard-coded like PBKDF2-SHA1 is now. New users would
     receive the SHA512 version. If password migration is enabled, all
     hashes would be automatically upgraded to PBKDF2-512 when a user
     logs in. This is the simplest choice.

  2) I can add configuration settings for
       * the default hash
       * hashes that should be upgraded

In either case, old password entries can still be used by a user to
log into Roundup.

Currently the only password storage related items exposed in config.ini are:

  password_pbkdf2_default_rounds - the work factor for PBKDF based methods

  migrate_passwords - if true, migrate passwords from deprecated to
                      the default hashing mode.

Option 2 would increase the number of thing the user needs to look
at. I am not sure if its worth it. I don't remember anybody ever
requesting the ability to set the default hash method. Nor do I
remember anybody asking to upgrade a subset of deprecated methods.

I would also like to deprecate SSHA (salted sha-1) hashes at the same
time. IIRC it was a heavily used hashing method for LDAP passwords. I
don't know if anybody is using SSHA these days.

Quips, comments, evasions, questions, and answers welcome.

--
				-- rouilj
John Rouillard
===========================================================================
My employers don't acknowledge my existence much less my opinions.