Inspiring people toshare
TYPO3camp Munich - 11./12. September 2010
Secure password storing with saltedpasswords
Image: Carlos Porto / FreeDigitalPhotos.net
Inspiring people toshareSecure password storing with saltedpasswords
Secure password storing with TYPO3’ssystem extension “saltedpasswords”
Steffen Gebert <[email protected]>
TYPO3camp Munich- 11./12. September 2010
Translated slides, original title:“TYPO3-Passwörter sicher speichern mit saltedpasswords”
http://www.slideshare.net/StephenKing/passwrter-in-typo3-sicher-speichern-mit
Inspiring people toshareSecure password storing with saltedpasswords
Introduction
Your Speaker
Steffen Gebert
Student, Freelancer
TYPO3 Core Team Member
Inspiring people toshare
Introduction
Secure password storing with saltedpasswords
Ouch!TYPO3 Assicciation, 3rd Quarterly Report 2008
“What happened? An unauthorized person gained administrative access to the typo3.org website. As far as we can tell, an admin password was stolen and used to find out more passwords on typo3.org.”
Inspiring people toshare
Introduction
Secure password storing with saltedpasswords
Saving passwordsDefinite no-go: Storing cleartext password
Instead
Saving of a hash (“check sum”)
Comparing with hash during login
Inspiring people toshare
Introduction
Secure password storing with saltedpasswords
Fundamental knowledge: HashingOne-way function
identical input => identical outputmd5(‘joh316’) = ‘bacb98acf97e0b6112b1d1b650b84971’
opposite direction not argorithmically computable
Most frequently used algorithm: MD5
not considered secure since ages (clashes easy to compute, huge rainbow tables available)
Alternatives (SHA) only provide bigger result set=> just new rainbow tables needed
Inspiring people toshare
Introduction
Secure password storing with saltedpasswords
Saving a salted passwordUser input: ‘joh316’
Generate salt, e.g. ‘7deb882cf’
Compute Hashmd5(‘7deb882cf’ . ‘joh316’) = ‘bacedc598493cb316044207d95f7ad54’
Save salt and hash
Inspiring people toshare
Introduction
Secure password storing with saltedpasswords
Validating a salted passwordUser intut: ‘joh316’
Read used salt from database: ‘7deb882cf’
Compute hashmd5(‘7deb882cf’ . ‘joh316’) = ‘bacedc598493cb316044207d95f7ad54’
Compare with saved hash
Inspiring people toshare
The Extension
Secure password storing with saltedpasswords
System extension saltedpasswordsFormerly t3sec_saltedpasswords by Marcus Krause, Member of the TYPO3 security team
Integration into TYPO3 Core version 4.3 after rework by Steffen Ritter
Inspiring people toshare
The Extension
Secure password storing with saltedpasswords
Implemented salting methodsSalted MD5
Portable PHP password hashing framework
Available for various PHP applications (Drupal etc.)
Repetetive exectution of MD5 (slow)
Blowfish
Availability dependent of environment
Starting with PHP 5.3 implementation shipped with PHP
Inspiring people toshare
The Extension
Secure password storing with saltedpasswords
Crux of the matter...Password must be available in plaintext
TYPO3 by default transfers MD5 hash
Plaintext transfer unsecure
Prerequisite (at least one)
SSL secured connection
System extension rsaauthEncrypts passwords prior transfer using RSA algorithm
Inspiring people toshare
Installation & Configuration
Secure password storing with saltedpasswords
rsaauthPrerequisite
OpenSSL: PHP extension recommended, binary as fallback
JavaScript
Activation
Frontend$TYPO3_CONF_VARS[FE][loginSecurityLevel] = ‘rsa’
Backend$TYPO3_CONF_VARS[BE][loginSecurityLevel] = ‘rsa’;
Inspiring people toshare
Installation & Configuration
Secure password storing with saltedpasswords
saltedpasswords with SSL encryptionFrontend
$TYPO3_CONF_VARS[FE][loginSecurityLevel] = ‘normal’
Backend
$TYPO3_CONF_VARS[BE][lockSSL] > 0
Inspiring people toshare
Installation & Configuration
Secure password storing with saltedpasswords
Installation of saltedpasswordsChecks availability of rsaauth or lockSSL
Separate activation for Frontend and Backend
Choice of hashing method
Inspiring people toshare
Compatibility
Secure password storing with saltedpasswords
Backwards compatibilityExisting passwords? (unsalted MD5)
immediate conversion not possible, as cleartext not available
only possible moment: during Login
Inspiring people toshare
Compatibility
Secure password storing with saltedpasswords
ExtensionsFrontend
felogin compatibel
srfeuserregister_t3secsaltedpw
Alternative FE-User registrations?
Adjustions for own extensions might be needed
Inspiring people toshare
Background knowledge
Secure password storing with saltedpasswords
Password formatsMD5 without saltbacb98acf97e0b6112b1d1b650b84971
MD5 with Saltstarts with $1$, 12 characters of salt$1$13NETowd$WFpl6npZF71YKkCCzGds2.
Blowfishstarts with $2a$, 22 characters of salt$2a$07$DZpLLz7wtIfhSSMwyEXjA.Nbh6rpDlqbgwVKa.IoDLyuLe5C7Jp8W
PHPASSstarts with $P$$P$Ccw7UIZ..SkvKBXDWnZlZ.qHcbktrB.
Inspiring people toshare
Background knowledge
Secure password storing with saltedpasswords
Password formats: Pro & ContraPHPASS
Low system requirements (compatible with every PHP version)
Requires PHPASS implementation in application
MD5 / Blowfish
Format of Unix’ crypt(), compatible with system services (/etc/passwd)
The better choice (?)
Availability of algorithms system dependent
with PHP 5.3.2 also SHA-256/512 possible
Inspiring people toshare
Background knowledge
Secure password storing with saltedpasswords
Usage of crypt()Password validation:crypt($user_input, $encrypted_password) == $encrypted_password
Saved hash (including salt):$1$13NETowd$WFpl6npZF71YKkCCzGds2.
Checking against saved password ‘joh316’
crypt(joh316, $1$13NETowd$WFpl6npZF71YKkCCzGds2.) = $1$13NETowd$WFpl6npZF71YKkCCzGds2.
crypt(password, $1$13NETowd$WFpl6npZF71YKkCCzGds2.) = $1$13NETowd$SeAArtswHd8jzc9SQvH691
Inspiring people toshareSecure password storing with saltedpasswords
Web linksFree Rainbow Tableshttp://www.freerainbowtables.com
PHPASShttp://www.openwall.com/phpass/
PHP Manual: crypt()http://de2.php.net/manual/en/function.crypt.php
Wikipedia: crypt (Unix)http://en.wikipedia.org/wiki/Crypt_(Unix)#Library_Function
Inspiring people toshareSecure password storing with saltedpasswords
?????????????
inspiring people to share.
