settingsLogin | Registersettings

[openstack-dev] [OSSN-0081] sha512_crypt is insufficient for password hashing

0 votes

sha512_crypt is insufficient for password hashing


Use of sha512_crypt for password hashing in versions of Keystone prior
to Pike, is insufficient and provides limited protection against
brute-forcing of password hashes.

Affected Services / Software

OpenStack Identity Service (Keystone). OpenStack Releases Ocata, Newton.


Keystone uses sha512crypt for password hashing. This provides
insufficient and limited protection, since sha512
crypt algorithm has a
low computational cost factor, therefore making it easier to crack
passwords offline in a short period of time.

The correct mechanism is to use the more secure hashing algorithms with
a higher computational cost factor such as bcrypt, scrypt, or
pbkdf2sha512 instead of sha512crypt.

Recommended Actions

It is recommended that operators upgrade to the Pike release where all
future passwords would be bcrypt hashed.

Operators should also force password changes on all users 1, which
will result in the users newly generated passwords being bcrypt hashed.

Contacts / References

Author: Luke Hinds
This OSSN :
Original LaunchPad Bug :
Mailing List : [Security] tag on
OpenStack Security Project :

OpenStack Development Mailing List (not for usage questions)

asked Sep 17, 2017 in openstack by Luke_Hinds (1,500 points)  ‚óŹ 1