Re: Should Roundup replace current password hash with a new one.

* John P. Rouillard <[email protected]> [20230228 23:38]:
> work-factor which increases the number of rounds used when hashing the
> stored password. For a long time that factor was 10000.

> The 2.3.0 release will increase it to 2,000,000 and admins will have to
> make the change when they upgrade.

> However PBKDF2 can be used with SHA512 rather than SHA1. The number of
> rounds (work-factor) needed for that is less, but more computation is
> required for SHA512 versus SHA1.

How long will logins take with this increased settings on a hardware
that is a bit older or less powerful in general (does anyone use
Roundup on Raspberry Pis?)

100000 rounds with SHA1 on an AMD Opteron 6128 are fine, we use
this in Moin wikis, I'm a bit scared to try 2000000 though :)

> I would also like to deprecate SSHA (salted sha-1) hashes at the same
> time. IIRC it was a heavily used hashing method for LDAP passwords. I
> don't know if anybody is using SSHA these days.

SSHA is still used in some places, but regarding Roundup deprecating
it should be fine.

Regards,

Thomas

-- 
Thomas Arendsen Hein <[email protected]>  |  https://intevation.de
Intevation GmbH, Osnabrueck, DE; Amtsgericht Osnabrueck, HRB 18998
Geschaeftsfuehrer: Frank Koormann, Bernhard Reiter