[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <6bc72013-a061-9025-7b50-7e35f63f45f3@redhat.com>
Date: Sun, 17 Sep 2017 12:27:41 +0100
From: Luke Hinds <lhinds@...hat.com>
To: oss-security <oss-security@...ts.openwall.com>
Subject: [OSSN-0081] sha512_crypt is insufficient for password hashing
sha512_crypt is insufficient for password hashing
-------------------------------------------------
### Summary ###
Use of sha512_crypt for password hashing in versions of Keystone prior
to Pike, is insufficient and provides limited protection against
brute-forcing of password hashes.
### Affected Services / Software ###
OpenStack Identity Service (Keystone). OpenStack Releases Ocata, Newton.
### Discussion ###
Keystone uses sha512_crypt for password hashing. This provides
insufficient and limited protection, since sha512_crypt algorithm has a
low computational cost factor, therefore making it easier to crack
passwords offline in a short period of time.
The correct mechanism is to use the more secure hashing algorithms with
a higher computational cost factor such as bcrypt, scrypt, or
pbkdf2_sha512 instead of sha512_crypt.
### Recommended Actions ###
It is recommended that operators upgrade to the Pike release where all
future passwords would be bcrypt hashed.
Operators should also force password changes on all users [1], which
will result in the users newly generated passwords being bcrypt hashed.
### Contacts / References ###
Author: Luke Hinds <lhinds@...hat.com>
[1]:
https://docs.openstack.org/keystone/latest/admin/identity-security-compliance.html#force-users-to-change-password-upon-first-use
[2] http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-63b.pdf
This OSSN : https://wiki.openstack.org/wiki/OSSN/OSSN-0081
Original LaunchPad Bug : https://bugs.launchpad.net/ossn/+bug/1668503
Mailing List : [Security] tag on openstack-dev@...ts.openstack.org
OpenStack Security Project : https://launchpad.net/~openstack-ossg
Download attachment "signature.asc" of type "application/pgp-signature" (489 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
