3 ms·
In the context of (unsalted) MD5 passwords: If they have a large legacy base of MD5 hashed ones, how would one "move" those to a stronger hash function? I can
by blauditore 10y ago
In the context of (unsalted) MD5 passwords: If they have a large legacy base of MD5 hashed ones, how would one "move" those to a stronger hash function?
I can imagine something like re-hashing the existing one with a better algorithm and some salt, and storing new ones solely using the new algorithm + salt. But that introduces some additional complexity because every hash needs information about how it was hashed (MD5 + X vs. just X).
Is there an established best practice for this?
- syncsynchalt 10y agoYes, there is. The one I prefer, which you've mostly laid out, is: new passwords are entered as bcrypt(pw) and then stored as "B-$result", old passwords are re-hashed as bcrypt(hash) = bcrypt(md5(pw)) and stored as "M-$result", then your auth function works as follows: def auth(user, pw): hash = get_hash(user) if hash starts with "B-": return hash == bcrypt(pw) else if hash starts with "M-": return hash == bcrypt(md5(pw)) else: # remove this once you've rehashed your entire database return hash == md5(pw) The naïve solution is to skip the "B-"/"M-"/"" annotation but if you do that you've introduced a situation where attackers can login to old passwords using md5 leaked from another source.
- HappyTypist 10y agoThe other solution (that Yahoo used) is use bcrypt(md5(password)) which allows them to rehash all existing passwords without logging in.
- blauditore 10y agoI think that's what he described, plus adding a prefix in order to indicate it's been re-hashed.
- syncsynchalt 10y agoThat's exactly right, thank you!