Spring/spring-security
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Update default configuration for Pbkdf2PasswordEncoder

Browse Source 
The recommended minimums for PBKDF2, as per OWASP Cheat Sheet Series (https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html), are:
If FIPS-140 compliance is required, use PBKDF2 with a work factor of 310,000 or more and set with an internal hash function of HMAC-SHA-256.

Previous default configuration:
algorithm=SHA1, iterations=185000, hashLength=256

New default configuration:
algorithm=SHA256, iterations=310000, hashLength=256

The default salt length was also updated from 8 to 16.

Closes gh-10506, Closes gh-10489
This commit is contained in:
Joe Grandja
2022-09-26 16:35:10 -04:00
parent f8419003eb
commit c50441b59f
4 changed files with 126 additions and 29 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
crypto/src/test/java/org/springframework/security/crypto/factory/PasswordEncoderFactoriesTests.java
View File

@@ -75,6 +75,12 @@ public class PasswordEncoderFactoriesTests {
assertThat(this.encoder.matches(this.rawPassword, encodedPassword)).isTrue();
}
@Test
public void matchesWhenPbkdf2SpringSecurity_v5_8ThenWorks() {
String encodedPassword = "{pbkdf2@SpringSecurity_v5_8}fefe5120467e5d4ccff442dbb2fa86d276262d97435c0c54e5eebced51ffd144fcb05eb53fea2677216c4f3250010006";
assertThat(this.encoder.matches(this.rawPassword, encodedPassword)).isTrue();
}
@Test
public void matchesWhenSCryptThenWorks() {
String encodedPassword = "{scrypt}$e0801$8bWJaSu2IKSn9Z9kM+TPXfOc/9bdYSrN1oD9qfVThWEwdRTnO7re7Ei+fUZRJ68k9lTyuTeUp4of4g24hHnazw==$OAOec05+bXxvuu/1qZ6NUR+xQYvYv7BeL1QxwRpY5Pc=";

10
crypto/src/test/java/org/springframework/security/crypto/password/Pbkdf2PasswordEncoderTests.java
View File

@@ -1,5 +1,5 @@
/*
* Copyright 2002-2020 the original author or authors.
* Copyright 2002-2022 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -198,6 +198,14 @@ public class Pbkdf2PasswordEncoderTests {
assertThat(this.encoderSalt16.matches(rawPassword, encodedPassword)).isTrue();
}
@Test
public void matchWhenDefaultsForSpringSecurity_v5_8ThenSuccess() {
Pbkdf2PasswordEncoder encoder = Pbkdf2PasswordEncoder.defaultsForSpringSecurity_v5_8();
String rawPassword = "password";
String encodedPassword = "fefe5120467e5d4ccff442dbb2fa86d276262d97435c0c54e5eebced51ffd144fcb05eb53fea2677216c4f3250010006";
assertThat(encoder.matches(rawPassword, encodedPassword)).isTrue();
}
/**
* Used to find the iteration count that takes .5 seconds.
*/