jabberd2/jabberd2 — pull request #78 by lifeofguenter (2014-08-27 23:00:36+00:00)
Title: secure password storage

I would like to introduce some changes which will benefit the current security of password handling.

1) ability to use crypt_blowfish as hash algorithm
2) create secure salt with openssl instead of using "rand()"
3) timing attack secure hash comparison
4) make cost configurable (xml-config)
5) use crypt standard, e.g. we can parse hashes and know:
-> used algorithm
-> optionally: cost
-> salt
-> hash
All in a single retrieval (e.g. without extra data lookups) which enables us also to do rehashing if needed (for example updated algorithm or cost) and totally transparent to the user
6) by using (b)crypt, we can create same secure hashes (even for example for logins) with PHP, Perl, Ruby, Golang (and most probably any other programming language) without looking up "how jabberd2 has done it"
7) currently only mysql-storage is supported, but we would like to see a more "global" approach to this problem, as many storages share the same functionality

Would be happy to hear some feedback :)

Currently only mysql as