28

There's plenty of discussion on the best algorithm - but what if you're already in production? How do you upgrade without having to reset on the user?


EDIT/DISCLAIMER: Although I originally wanted a "quick fix" solution and chose orip's response, I must concede that if security in your application is important enough to be even bothering with this issue, then a quick fix is the wrong mentality and his proposed solution is probably inadequate.

7
  • 2
    Upgrade from what to what? If you're upgrading from "no hashing" to "hashing", then there should be no problem. Oct 17, 2010 at 20:52
  • 1
    @Greg hashing to hashing - I sure hope no-one on SO is storing plaintext :)
    – Anson Kao
    Oct 17, 2010 at 21:33
  • 2
    You got the wrong answer, the implementation is still vulnerable to collision. Just hash the plain text when they login next.
    – rook
    Oct 18, 2010 at 4:46
  • duplicate of: stackoverflow.com/questions/1533744/…
    – Jacco
    Oct 18, 2010 at 11:24
  • @Jacco - my apologies @Rook - I will revise
    – Anson Kao
    Oct 18, 2010 at 16:47

6 Answers 6

25

One option is to make your stored hash include an algorithm version number - so you start with algorithm 0 (e.g. MD5) and store

0:ab0123fe

then when you upgrade to SHA-1, you bump the version number to 1:

1:babababa192df1312

(no, I know these lengths probably aren't right).

That way you can always tell which version to check against when validating a password. You can invalidate old algorithms just by wiping stored hashes which start with that version number.

If you've already got hashes in production without a version number, just choose a scheme such that you can easily recognise unversioned hashes - for example, using the above scheme of a colon, any hash which doesn't contain a colon must by definition predate the versioning scheme, so can be inferred to be version 0 (or whatever).

9
  • 6
    My first thought would be to store that hash version number in its own field. Not rhetorical: why include it in the string?
    – Matchu
    Oct 17, 2010 at 20:57
  • 2
    @Matchu: Since one is useless without the other, storing them in the same field ensures that you never run into a situation where you have one and not the other.
    – Amber
    Oct 17, 2010 at 21:04
  • 4
    @Matchu it's pretty much the same thing, but you're right, storing it in a separate field would make it easier to query the table to see how many users have been upgraded
    – Anson Kao
    Oct 17, 2010 at 21:05
  • 1
    This keeps the old weak hashes in the db, at least until the user logs in the next time. So using the double hash technique (similar to orip's post but with salt) on the old hashes should be used in addition to this. Oct 18, 2010 at 18:05
  • 1
    @Slartibartfast: Unless you happen to use "crypt", "md5" or "sha", it's basically equivalent to using RFC 2307... so in what way is RFC 2307 a good plan, but an equivalent one isn't? They both basically keep the algorithm used to perform the hash along with the hash itself.
    – Jon Skeet
    Oct 25, 2010 at 5:48
22

A cool way to secure all the existing passwords: use the existing hash as the input for the new, and better, password hash.

So if your existing hashes are straight MD5s, and you plan on moving to some form of PBKDF2 (or bcrypt, or scrypt), then change your password hash to:

PBKDF2( MD5( password ) )

You already have the MD5 in your database so all you do is apply PBKDF2 to it.

The reason this works well is that the weaknesses of MD5 vs other hashes (e.g. SHA-*) don't affect password use. For example, its collision vulnerabilities are devastating for digital signatures but they don't affect password hashes. Compared to longer hashes MD5 reduces the hash search-space somewhat with its 128-bit output, but this is insignificant compared to the password search space itself which is much much smaller.

What makes a password hash strong is slowing down (achieved in PBKDF2 by iterations) and a random, long-enough salt - the initial MD5 doesn't adversely affect either of them.

And while you're at it, add a version field to the passwords too.

EDIT: The cryptography StackExchange has an interesting discussion on this method.

26
  • 1
    +1 This is what I was looking for, all other responses take a long time to complete the upgrade and may require resetting users that don't log in for a long time.
    – Anson Kao
    Oct 17, 2010 at 21:16
  • +1 for simplicity. My solution (and just about everyone else's) requires all users log in.
    – mellowsoon
    Oct 17, 2010 at 21:24
  • True. If you have a really, really bad password scheme right now, e.g. unsalted MD5, it might be important to shift everyone immediately. It has the potential to become confusing in the long term, but it's a good short-term solution.
    – Matchu
    Oct 17, 2010 at 21:25
  • 4
    @MicE - The security against brute-force attacks is as strong as its weakest link - which in this case is the passwords themselves, not the hash. The range of the passwords is much smaller than the range of the hashes, and rehashing - although theoretically losing some of the range - is insignificant in comparison. In fact, internally PBKDF2 re-hashes the password thousands of times or more. For example, to get the equivalent of 128-bits of entropy in your password you'd need a 20-character completely-random password from all the available keyboard characters, including all special characters.
    – orip
    Oct 17, 2010 at 23:32
  • 1
    Where is the salt in this scheme? Oct 18, 2010 at 2:24
11

Wait until your user logs in (so you have the password in plaintext), then hash it with the new algorithm & save it in your database.

0
2

One way to do it is to:

  • Introduce new field for new password
  • When the user logs in check the password against the old hash
  • If OK, hash the clear text password with the new hash
  • Remove the old hash

Then gradually you will have only passwords with the new hash

0

You probably can't change the password hashing scheme now, unless you're storing passwords in plain text. What you can do is re-hash the member passwords using a better hashing scheme after each user has successfully logged in.

You can try this:

First add a new column to your members table, or which ever table stores passwords.

ALTER TABLE members ADD is_pass_upgraded tinyint(1) default 0;

Next, in your code that authenticates users, add some additional logic (I'm using PHP):

<?php
$username = $_POST['username'];
$password = $_POST['password'];

$auth_success = authenticateUser($username, $password); 
if (!$auth_success) {
    /**
     * They entered the wrong username/password. Redirect them back
     * to  the login page.
     */
} else {
    /**
     * Check to see if the member's password has been upgraded yet
     */
    $username = mysql_real_escape_string($username);
    $sql = "SELECT id FROM members WHERE username = '$username' AND is_pass_upgraded = 0 LIMIT 1";
    $results = mysql_query($sql);

    /**
     * Getting any results from the query means their password hasn't been
     * upgraded yet. We will upgrade it now.
     */
    if (mysql_num_rows($results) > 0) {
        /**
         * Generate a new password hash using your new algorithm. That's
         * what the generateNewPasswordHash() function does.
         */
        $password = generateNewPasswordHash($password);
        $password = mysql_real_escape_string($password);

        /**
         * Now that we have a new password hash, we'll update the member table
         * with the new password hash, and change the is_pass_upgraded flag.
         */
        $sql = "UPDATE members SET password = '$password', is_pass_upgraded = 1 WHERE username = '$username' LIMIT 1";
        mysql_query($sql);
    }
}

Your authenticateUser() function would need to be changed to something similar to this:

<?php
function authenticateUser($username, $password)
{
    $username = mysql_real_escape_string($username);

    /**
     * We need password hashes using your old system (md5 for example)
     * and your new system.
     */
    $old_password_hashed = md5($password);
    $new_password_hashed = generateBetterPasswordHash($password);
    $old_password_hashed = mysql_real_escape_string($old_password_hashed);
    $new_password_hashed = mysql_real_escape_string($new_password_hashed);

    $sql = "SELECT *
        FROM members
        WHERE username = '$username'
        AND
        (
            (is_pass_upgraded = 0 AND password = '$old_password_hashed')
            OR
            (is_pass_upgraded = 1 AND password = '$new_password_hashed')
        )
        LIMIT 1";
    $results = mysql_query($sql);
    if (mysql_num_rows($results) > 0) {
        $row = mysql_fetch_assoc($results);
        startUserSession($row);
        return true;
    } else {
        return false;
    }
}

There's upsides and downsides to this approach. On the upsides, an individual member's password becomes more secure after they've logged in. The downside is everyone's passwords aren't secured.

I'd only do this for maybe 2 weeks. I'd send an email to all my members, and tell them they have 2 weeks to log into their account because of site upgrades. If they fail to log in within 2 weeks they'll need to use the password recovery system to reset their password.

1
  • 1
    Where's the salt? Also, why have a separate flag field instead of a prefix (as others have suggested)? Oct 18, 2010 at 2:26
0

Just re-hash the plain text when they authenticate the next time. Oah and use SHA-256 with a salt of base256 (full byte) and 256 bytes in size.

13
  • 1
    SHA-256 has 'fast' as one of it's design goals. 'fast' is not a desirable feature for password hashing. Adaptable cost hashing schemes (BCrypt hash for example) are better suited for password hashing.
    – Jacco
    Oct 18, 2010 at 11:23
  • @Jacco If its too heavy for an attacker to lift its too heavy for your web server. No slow message digest function will be approved by NIST. Look at the wiki page for PBKDF2, it is only used by applications where 1 user is logging in at a time.
    – rook
    Oct 18, 2010 at 15:46
  • Rook, once again, you should have at least mentioned the use of salt. Oct 18, 2010 at 17:32
  • @Steven Sudit you should assume that none of my code or suggestions violates a CWE.
    – rook
    Oct 18, 2010 at 17:42
  • Rook, whether your implementation has violations is not the issue: due to omission, the system you describe does have violations. I'm suggesting that you at least nod towards random salting, and perhaps towards HMAC as the way to mix that salt in. Oct 18, 2010 at 17:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.