sonatype/nexus — pull request #782 by scarlucci (2013-03-20 14:50:59+00:00)
Title: REVIEW: Enhance password hashing

These changes are for NXCM-4361, which requested that we start salting password hashes. The bulk of the changes for this task are in sonatype/security, which has a corresponding pull request open

Salting:
Passwords are now salted prior to hashing. Salts are unique per user, per password. The salt is stored along side the password hash in security.xml. The model version of security.xml has been updated

Hashing algorithm:
Passwords are now hashed with SHA-512. Previously, passwords were hashed with SHA-1. The credentials matcher is backwards compatible with SHA-1 and MD5 hashes

Key Stretching:
The hashing algorithm is now applied N times, where N is defined in security-configuration.xml, in the new hashIterations element. The model version of security-configuration.xml has been updated.

Upgrading legacy users:
In order to convert old SHA-1 password hashes, we must wait for the user to login. When they do, we detect that their password hash is old, generate a unique salt, and regenerate a SHA-512 hash