Bug #55850 for Catalyst-Plugin-Authentication: SECURITY: Hashed password, broken implementation of salt.

On Tue Mar 23 16:15:09 2010, ECARROLL wrote: Show quoted text
(pre-calculated) Show quoted text
So use salted_hash which uses Crypt::SaltedHash. Or, set the salt to a random value on each request.

Show quoted text
I think you're missing something -- or I am. How do you propose to set it to a different value on each request if if the salt is being read from the configuration and not the call to authenticate? Should I modify the global configuration of C:P:A from the Controller? That sounds hackish. Moreover, the traditional method of salting is to store the salt in the DB? If this is used, should I retrieve the salt with the Authentication plugin's model? That would sound silly. Crypt::SaltHash makes the salt a function of the username, I haven't looked too much into the implementation but it certainly isn't the normal method of salting -- though it most probably helps some level. The obvious solution to this will be to have a `salt_field`, that when filled out retrieves the salt from the userinfo. I'll see about a patch tomorrow. -- Evan Carroll System Lord of the Internets http://www.evancarroll.com

http://search.cpan.org/src/FLORA/Catalyst-Plugin-Authentication- 0.10016/lib/Catalyst/Authentication/Credential/Password.pm I think I've got the right one... P.S. stop being an asshole, thanks. -- Evan Carroll System Lord of the Internets http://www.evancarroll.com

I think the solution is just to use bcrypt from Authen::Passphrase. BTW, Evan, you aren't entirely right about salts. If your salt is 2309874kjsdhflkasjdfho982374, then the attacker still have to make a new database for your site. So the security case is: 1) Your password database is compromised. 2) You used the same salt for everything. 3) Attacker calculates common passwords with your salt. 4) Accounts are compromised. If the salt is random per-password: 1) Your password database is compromised. 2) Same as above except you only try one account at the time, making the attack n-times more complicated, where n == number of accounts. If you just use bcrypt instead: 1) Your password database is compromised. 2) Each rainbow table entry takes about 3 seconds to compute. 3) Attacker types "jrockway/1l0v3hell0k1tty" at the login screen and fails. 4) Attacker gives up because bcrypt is 2^<big number> times slower than sha1, and brute-force attacks are infeasible. Everything I've read recently about passwords with Catalyst say to use bcrypt, so I am not too worried about this. Thanks for bringing this issue to our attention in the least annoying way possible, though. Regards, Jonathan Rockway -- print just => another => perl => hacker => if $,=$"