You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@couchdb.apache.org by "rnewson (via GitHub)" <gi...@apache.org> on 2025/02/11 14:25:18 UTC
[PR] Add simple+pbkdf2 migration password scheme [couchdb]
rnewson opened a new pull request, #5429:
URL: https://github.com/apache/couchdb/pull/5429
## Overview
Introduces a new password scheme intended to help administrators transitioning from the legacy "simple" scheme to the strong "pbkdf2" scheme. By wrapping existing simple credentials with pbkdf2 we protect them better until such times as they are used (at which point they will be upgraded to the currently configured scheme).
## Testing recommendations
N/A
## Related Issues or Pull Requests
N/A
## Checklist
- [x] Code is written and works correctly
- [x] Changes are covered by tests
- [ ] Any new configurable parameters are documented in `rel/overlay/etc/default.ini`
- [ ] Documentation changes were made in the `src/docs` folder
- [ ] Documentation changes were backported (separated PR) to affected branches
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@couchdb.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Add simple+pbkdf2 migration password scheme [couchdb]
Posted by "big-r81 (via GitHub)" <gi...@apache.org>.
big-r81 commented on code in PR #5429:
URL: https://github.com/apache/couchdb/pull/5429#discussion_r1951511027
##########
src/docs/src/intro/security.rst:
##########
@@ -312,6 +312,59 @@ several *mandatory* fields, that CouchDB needs for authentication:
Additionally, you may specify any custom fields that relate to the target
user.
+Password Schemes
+----------------
+
+CouchDB supports several password hashing schemes:
+
+Simple
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+The original hashing scheme (``simple`` in ``password_scheme`` field) is a
+single iteration of SHA-1 over the password combined with the salt value. It is
+too weak today, unless the password has especially high entropy.
+
+PBKDF2
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+The PBKDF2 hashing scheme (``pbkdf2`` in ``password_scheme`` field) is a
+multiple iteration algorithm using a member of the SHA-2 family. The number of
+iterations is configurable.
+
+Simple plus PBKDF2
+^^^^^^^^^^^^^^^^^^
+
+To aid migration a combined scheme is also available (``simple+pbkdf2`` in
+``password_scheme`` field). If you have ``simple`` credentials in your
+``_users`` database that you don't wish to delete, but are currently unable to
+authenticate with, you can convert the credential to the ``simple+pbkdf2``
+scheme without needing to know the password. CouchDB will apply the ``simple``
+scheme first and then the ``pkbdf2`` algorithm to the result.
+
+Example code to convert ``simple`` to ``simple+pbkdf2`` (Python):
+
+.. code-block:: python
+
+ import hashlib
+
+ hashlib.pbkdf2_hmac('sha256', password_sha, b'salthere', 10000).hex()
Review Comment:
same here - iterations count?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@couchdb.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Add simple+pbkdf2 migration password scheme [couchdb]
Posted by "big-r81 (via GitHub)" <gi...@apache.org>.
big-r81 commented on code in PR #5429:
URL: https://github.com/apache/couchdb/pull/5429#discussion_r1951524861
##########
src/couch/src/couch_httpd_auth.erl:
##########
@@ -656,24 +656,33 @@ authenticate_int(Pass, UserSalt, UserProps) ->
{PasswordHash, ExpectedHash} =
case couch_util:get_value(<<"password_scheme">>, UserProps, <<"simple">>) of
<<"simple">> ->
- {
- couch_passwords:simple(Pass, UserSalt),
- couch_util:get_value(<<"password_sha">>, UserProps, nil)
- };
+ authenticate_int_simple(Pass, UserSalt, UserProps);
<<"pbkdf2">> ->
- PRF = couch_util:get_value(<<"pbkdf2_prf">>, UserProps, <<"sha">>),
- verify_prf(PRF),
- Iterations = couch_util:get_value(<<"iterations">>, UserProps, 10000),
- verify_iterations(Iterations),
- {
- couch_passwords:pbkdf2(
- binary_to_existing_atom(PRF), Pass, UserSalt, Iterations
- ),
- couch_util:get_value(<<"derived_key">>, UserProps, nil)
- }
+ authenticate_int_pbkdf2(Pass, UserSalt, UserProps);
+ <<"simple+pbkdf2">> ->
+ LegacyHash = couch_passwords:simple(Pass, UserSalt),
+ authenticate_int_pbkdf2(LegacyHash, UserSalt, UserProps)
end,
couch_passwords:verify(PasswordHash, ExpectedHash).
+authenticate_int_simple(Pass, UserSalt, UserProps) ->
+ {
+ couch_passwords:simple(Pass, UserSalt),
+ couch_util:get_value(<<"password_sha">>, UserProps, nil)
+ }.
+
+authenticate_int_pbkdf2(Pass, UserSalt, UserProps) ->
+ PRF = couch_util:get_value(<<"pbkdf2_prf">>, UserProps, <<"sha">>),
+ verify_prf(PRF),
+ Iterations = couch_util:get_value(<<"iterations">>, UserProps, 10000),
Review Comment:
Should this be 600000 too?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@couchdb.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Add simple+pbkdf2 migration password scheme [couchdb]
Posted by "rnewson (via GitHub)" <gi...@apache.org>.
rnewson merged PR #5429:
URL: https://github.com/apache/couchdb/pull/5429
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@couchdb.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Add simple+pbkdf2 migration password scheme [couchdb]
Posted by "big-r81 (via GitHub)" <gi...@apache.org>.
big-r81 commented on code in PR #5429:
URL: https://github.com/apache/couchdb/pull/5429#discussion_r1951509747
##########
src/docs/src/intro/security.rst:
##########
@@ -312,6 +312,59 @@ several *mandatory* fields, that CouchDB needs for authentication:
Additionally, you may specify any custom fields that relate to the target
user.
+Password Schemes
+----------------
+
+CouchDB supports several password hashing schemes:
+
+Simple
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+The original hashing scheme (``simple`` in ``password_scheme`` field) is a
+single iteration of SHA-1 over the password combined with the salt value. It is
+too weak today, unless the password has especially high entropy.
+
+PBKDF2
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+The PBKDF2 hashing scheme (``pbkdf2`` in ``password_scheme`` field) is a
+multiple iteration algorithm using a member of the SHA-2 family. The number of
+iterations is configurable.
+
+Simple plus PBKDF2
+^^^^^^^^^^^^^^^^^^
+
+To aid migration a combined scheme is also available (``simple+pbkdf2`` in
+``password_scheme`` field). If you have ``simple`` credentials in your
+``_users`` database that you don't wish to delete, but are currently unable to
+authenticate with, you can convert the credential to the ``simple+pbkdf2``
+scheme without needing to know the password. CouchDB will apply the ``simple``
+scheme first and then the ``pkbdf2`` algorithm to the result.
+
+Example code to convert ``simple`` to ``simple+pbkdf2`` (Python):
+
+.. code-block:: python
+
+ import hashlib
+
+ hashlib.pbkdf2_hmac('sha256', password_sha, b'salthere', 10000).hex()
+
+The result should be stored in the ``derived_key`` field of the user doc.
+
+Example user doc:
+
+.. code-block:: javascript
+
+ {
+ "type": "user",
+ "name": "user1",
+ "password_scheme": "simple+pbkdf2",
+ "derived_key": "result from above",
+ "pbkdf2_prf": "sha256",
+ "iterations": 10000,
Review Comment:
I know thats an example, but should we use a recommended iterations count of 600000 here?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@couchdb.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Add simple+pbkdf2 migration password scheme [couchdb]
Posted by "big-r81 (via GitHub)" <gi...@apache.org>.
big-r81 commented on code in PR #5429:
URL: https://github.com/apache/couchdb/pull/5429#discussion_r1952570966
##########
src/docs/src/intro/security.rst:
##########
@@ -312,6 +312,64 @@ several *mandatory* fields, that CouchDB needs for authentication:
Additionally, you may specify any custom fields that relate to the target
user.
+Password Schemes
+----------------
+
+CouchDB supports several password hashing schemes:
+
+Simple
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
Review Comment:
I think, that the lines below and above a header must match the length of the text.
##########
src/docs/src/intro/security.rst:
##########
@@ -312,6 +312,64 @@ several *mandatory* fields, that CouchDB needs for authentication:
Additionally, you may specify any custom fields that relate to the target
user.
+Password Schemes
+----------------
+
+CouchDB supports several password hashing schemes:
+
+Simple
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+.. warning::
+
+ Deprecated
+
+The original hashing scheme (``simple`` in ``password_scheme`` field) is a
+single iteration of SHA-1 over the password combined with the salt value. It is
+too weak today, unless the password has especially high entropy.
+
+PBKDF2
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
Review Comment:
I think, that the lines below and above a header must match the length of the text.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@couchdb.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org