joomla/joomla-cms — pull request #2555 by Hackwar (2013-11-18 22:32:42+00:00)
Title: Fixing the extended password encryption implementation (bcrypt)

This PR fixes a series of issues with the bcrypt implementation in 3.2.0.

* There are no "too long passwords". Even if bcrypt only uses the first 55 chars, the password_hash() function in PHP takes arbitrary long passwords and truncates them itself if necessary. No need to do that ourselfs and potentially weaken the system for future algorithms or changes to bcrypt.
* Reducing the choice of encryption algorithms to only md5-hex and bcrypt by an arbitrary Joomla CMS plugin is very bad style. This change has a default of bcrypt and is overrideable with a constant. Yes, the constant is maybe not the cleanest solution, but it is a lot better than introducing unnecessary couplings. This also now allows a third party plugin to set the encryption and to unpublish the "User - Joomla" plugin.
* Joomla should not fuzz the encryption algorithm used for the password. There is no gain in hiding the encryption algorithm from a potential attacker. Instead it will eventually produce collisions between other algorithms, so Joomla should properly note the used algorithm in the password column.
* Most importantly, you can now switch randomly between encryption algorithms. In the implementation before, you could only go from MD5 to bcrypt. If you disabled bcrypt in the plugin parameters again, you couldn't get the passwords checked against bcrypt and then reverted to MD5 again.
* Besides all of this, it also fixes the issue that you can't login and fixes the hashes from those that registered before 3.2.1

Please test and comment.