You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@couchdb.apache.org by rn...@apache.org on 2023/10/20 16:46:11 UTC
[couchdb] 06/07: increase default iterations for new credentials
This is an automated email from the ASF dual-hosted git repository.
rnewson pushed a commit to branch decouple_offline_hash_strength_from_online
in repository https://gitbox.apache.org/repos/asf/couchdb.git
commit 721d1426d724f36346ea4bbd5186376cf9367816
Author: Robert Newson <rn...@apache.org>
AuthorDate: Fri Oct 20 15:56:07 2023 +0100
increase default iterations for new credentials
---
rel/overlay/etc/default.ini | 2 +-
src/couch/src/couch_passwords.erl | 2 +-
src/couch/src/couch_users_db.erl | 2 +-
3 files changed, 3 insertions(+), 3 deletions(-)
diff --git a/rel/overlay/etc/default.ini b/rel/overlay/etc/default.ini
index 1604f1585..e93916901 100644
--- a/rel/overlay/etc/default.ini
+++ b/rel/overlay/etc/default.ini
@@ -321,7 +321,7 @@ bind_address = 127.0.0.1
;timeout = 600 ; number of seconds before automatic logout
;auth_cache_size = 50 ; size is number of cache entries
;allow_persistent_cookies = true ; set to false to disallow persistent cookies
-;iterations = 10 ; iterations for password hashing
+;iterations = 50000 ; iterations for password hashing
;min_iterations = 1
;max_iterations = 1000000000
;password_scheme = pbkdf2
diff --git a/src/couch/src/couch_passwords.erl b/src/couch/src/couch_passwords.erl
index 73a7db261..f96e61bfe 100644
--- a/src/couch/src/couch_passwords.erl
+++ b/src/couch/src/couch_passwords.erl
@@ -44,7 +44,7 @@ hash_admin_password("simple", ClearPassword) ->
?l2b("-hashed-" ++ couch_util:to_hex(Hash) ++ "," ++ ?b2l(Salt));
hash_admin_password("pbkdf2", ClearPassword) ->
PRF = chttpd_util:get_chttpd_auth_config("pbkdf2_prf", "sha256"),
- Iterations = chttpd_util:get_chttpd_auth_config("iterations", "10"),
+ Iterations = chttpd_util:get_chttpd_auth_config("iterations", "50000"),
Salt = couch_uuids:random(),
DerivedKey = couch_passwords:pbkdf2(
list_to_existing_atom(PRF),
diff --git a/src/couch/src/couch_users_db.erl b/src/couch/src/couch_users_db.erl
index f8d56882a..3dc3dffde 100644
--- a/src/couch/src/couch_users_db.erl
+++ b/src/couch/src/couch_users_db.erl
@@ -84,7 +84,7 @@ save_doc(#doc{body = {Body}} = Doc) ->
ok = validate_password(ClearPassword),
PRF = chttpd_util:get_chttpd_auth_config("pbkdf2_prf", "sha256"),
Iterations = chttpd_util:get_chttpd_auth_config_integer(
- "iterations", 10
+ "iterations", 50000
),
Salt = couch_uuids:random(),
DerivedKey = couch_passwords:pbkdf2(