settingsLogin | Registersettings

[openstack-dev] [OSSN-0081] sha512_crypt is insufficient for password hashing

0 votes

sha512_crypt is insufficient for password hashing

Summary

Use of sha512_crypt for password hashing in versions of Keystone prior
to Pike, is insufficient and provides limited protection against
brute-forcing of password hashes.

Affected Services / Software

OpenStack Identity Service (Keystone). OpenStack Releases Ocata, Newton.

Discussion

Keystone uses sha512crypt for password hashing. This provides
insufficient and limited protection, since sha512
crypt algorithm has a
low computational cost factor, therefore making it easier to crack
passwords offline in a short period of time.

The correct mechanism is to use the more secure hashing algorithms with
a higher computational cost factor such as bcrypt, scrypt, or
pbkdf2sha512 instead of sha512crypt.

Recommended Actions

It is recommended that operators upgrade to the Pike release where all
future passwords would be bcrypt hashed.

Operators should also force password changes on all users 1, which
will result in the users newly generated passwords being bcrypt hashed.

Contacts / References

Author: Luke Hinds lhinds@redhat.com
[2] http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-63b.pdf
This OSSN : https://wiki.openstack.org/wiki/OSSN/OSSN-0081
Original LaunchPad Bug : https://bugs.launchpad.net/ossn/+bug/1668503
Mailing List : [Security] tag on openstack-dev@lists.openstack.org
OpenStack Security Project : https://launchpad.net/~openstack-ossg


OpenStack Development Mailing List (not for usage questions)
Unsubscribe: OpenStack-dev-request@lists.openstack.org?subject:unsubscribe
http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev

asked Sep 17, 2017 in openstack by Luke_Hinds (1,500 points)  ‚óŹ 1
...