[jira] [Created] (DIRAPI-464) Stored-credential bcrypt work factor drives unbounded CPU cost at bind

["Emmanuel Lécharny (Jira)" <ji...@apache.org>]

Emmanuel Lécharny created DIRAPI-464:
----------------------------------------

             Summary: Stored-credential bcrypt work factor drives unbounded CPU cost at bind
                 Key: DIRAPI-464
                 URL: https://issues.apache.org/jira/browse/DIRAPI-464
             Project: Directory Client API
          Issue Type: Bug
    Affects Versions: 2.1.8
            Reporter: Emmanuel Lécharny
             Fix For: 2.1.9


An authenticated low-privilege user sets their own _userPassword_ to '_\{CRYPT\}$2a$30$<22-char salt>..._' (a syntactically valid _bcrypt_ hash with cost 30), then fires 16 concurrent binds to their own *DN* with garbage passwords; each forces the authenticator through 2^30-round _bcrypt_, pinning 16 cores for hours and starving all directory operations.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)

---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@directory.apache.org
For additional commands, e-mail: dev-help@directory.apache.org