April 2010 - Aur-dev - lists.archlinux.org

Re: [aur-dev] FS#17109: AUR passwords are not salted
by Linas 26 Jun '10

26 Jun '10

Loui Chang wrote: > Thank you for your suggestions. These are things that are best discussed > on the aur-dev mailing list. > > Seems like you've put some thought into this. Why don't you submit a > patch? > Thanks for your support. Here goes an attempt. I have mixed my suggestions with Denis idea of changing the hash algorithm at the same time plus a few bits I found on the way. Actions performed by this patch: salt to be NULL, in which case it is treated as md5 hashed password. *All entries can be automatically updated by a -to be written- script. *Removes add salt on login code, per above. *Salted passwords now use sha512 instead of md5. *Adds requirement on hash extension (usually bundled as static). *try_login() only performs one query to verify user login instead of 5. *generate_salt now uses mt_rand() *Reject passwords given by GET.

3 10

Re: [aur-dev] FS#17109: AUR passwords are not salted
by Linas 19 Apr '10

19 Apr '10

Loui Chang wrote: > Thank you for your suggestions. These are things that are best discussed > on the aur-dev mailing list. > > Seems like you've put some thought into this. Why don't you submit a > patch? > Thanks for your support. Here goes an attempt. I have mixed my suggestions with Denis idea of changing the hash algorithm at the same time plus a few bits I found on the way. Actions performed by this patch: salt to be NULL, in which case it is treated as md5 hashed password. *All entries can be automatically updated by a -to be written- script. *Removes add salt on login code, per above. *Salted passwords now use sha512 instead of md5. *Adds requirement on hash extension (usually bundled as static). *try_login() only performs one query to verify user login instead of 5. *generate_salt now uses mt_rand() *Reject passwords given by GET.

1 0

Re: [aur-dev] FS#17109: AUR passwords are not salted
by Loui Chang 18 Apr '10

18 Apr '10

On Sun 18 Apr 2010 01:01 +0200, Linas wrote: > Arch User Repository (AUR) wrote: > > The following task has a new comment added: > > > > FS#17109 - AUR passwords are not salted > > User who did this - Loui Chang (louipc) > > > > ---------- > > A patch has been committed to git which will salt the passwords. > > ---------- > > > > More information can be found at the following URL: > > http://bugs.archlinux.org/task/17109#comment60615 > > These are good news, however, I don't think it is as good as "it would be": > > > # get salt for this user > > $salt = get_salt($userID); > > if ($salt) { > > # use salt > > ... > > $passwd_result = mysql_fetch_row(db_query($passwd_q, $dbh)); > > } else { > > ... > > $nosalt_result = mysql_fetch_row(db_query($nosalt_q, $dbh)); > > } > > > This gratuitously changes one sql query for login to three. > > It could be done as: > "SELECT ID,Passwd,Salt FROM Users" .+ " WHERE ID = '$userID'"; > $result = mysql_fetch_row(....) > if ($result[0]) { return false; } //No such user > if ( salted_hash($passwd, $result[2]) == $result[1] ) { return true; } > if ( is_null($result[2]) && (md5($passwd) == $result[1]) { update hash; > return true; } > > > Since it already encapsulates the salting into a function, it would be > trivial to allow the > salting compatible with already stored passwords, so they can be updated > with a script: > > function salted_hash($passwd, $salt) > { > if (strlen($salt) != 32) { > trigger_error('Salt does not look like an md5 hash', E_USER_WARNING); > } > return md5($salt . md5($passwd)); > } > > Finally, generate_salt() would be safer using mt_rand() instead of rand(). Thank you for your suggestions. These are things that are best discussed on the aur-dev mailing list. Seems like you've put some thought into this. Why don't you submit a patch?

1 0

[aur-dev] [PATCH] Support for salted passwords
by Denis Kobozev 16 Apr '10

16 Apr '10

Hi archers, Here's a patch that adds support for storing salted passwords in the database. The salt is a random string for each user and is stored along with the password in the Users table. Salt is created and password is salted when old users log in. New users get salted passwords when they register. What do you think? Denis.

4 4

[aur-dev] [PATCH] add search only by name and use it as default
by Andrea Scarpino 15 Apr '10

15 Apr '10

This add the ability to search packages only by name and set it as default. The possibility to search by both is kept using Advanced Search. -- Andrea

4 5