sonatype/security — pull request #25 by scarlucci (2013-03-20 14:48:44+00:00)
Title: REVIEW: Enhance password hashing

These changes are for NXCM-4361, which requested that we start salting password hashes. There are also related changes in the sonatype/nexus repo.

Salting:
Passwords are now salted prior to hashing. Salts are unique per user, per password. The salt is stored along side the password hash in security.xml. The model version of security.xml has been updated

Hashing algorithm:
Passwords are now hashed with SHA-512. Previously, passwords were hashed with SHA-1. The credentials matcher is backwards compatible with SHA-1 and MD5 hashes

Key Stretching:
The hashing algorithm is now applied N times, where N is defined in security-configuration.xml, in the new hashIterations element. The model version of security-configuration.xml has been updated.

Upgrading legacy users:
In order to convert old SHA-1 password hashes, we must wait for the user to login. When they do, we detect that their password hash is old, generate a unique salt, and regenerate a SHA-512 hash