sonatype/security — pull request #26 by scarlucci (2013-04-05 16:14:18+00:00)
Title: REVIEW: Enhanced password hashing

These changes are for https://issues.sonatype.org/browse/NXCM-4361. There are corresponding changes for this work in sonatype/nexus

The goal of the changes is to use a more secure mechanism to hash user passwords. The changes leverage the new PasswordService feature in Shiro 1.2 to encapsulate all of the logic related to how we hash passwords.

Salting:
Passwords are now salted prior to hashing. Salts are unique per user, per password.

Hashing algorithm:
Passwords are now hashed with SHA-512. Previously, passwords were hashed with SHA-1. The password matcher is backwards compatible with SHA-1 and MD5 hashes

Key Stretching:
The hashing algorithm is now applied N times, where N is defined in security-configuration.xml, in the new hashIterations element. The model version of security-configuration.xml has been updated.

Upgrading legacy users:
In order to convert old SHA-1 password hashes, we must wait for the user to login. When they do, we detect that their password hash is old and regenerate the hash