XOOPS 
Forum
Forum Index General Forums Community Support Modules Support Themes Support Development International Support Module Hack Reviews Theme Designer Talk
  1. Board index / 
  2. XOOPS Community Support forums / 
  3. Q and A 
  4.  / using SHA-256 instead of md5
Register
1
bubuche93
using SHA-256 instead of md5

  • 2006/11/19 10:12

  • bubuche93

  • Just popping in

  • Posts: 25

  • Since: 2006/11/19


is it possible to encrypt the password using sha-256 instead of md5 in the XOOPS user table? how can i do?
md5 is VERY unsecure and my website has been hacked recently. 350+ students passwords have been stolen...

Thanks, Buche
2
Bender
Re: using SHA-256 instead of md5

  • 2006/11/19 10:41

  • Bender

  • Home away from home

  • Posts: 1899

  • Since: 2003/3/10


No. Only with hacking Xoops.

(the passwords could not be stolen. The best they can get if they get database access is the md5 hashes of the password since XOOPS does not store any userpasswords in cleartext anywhere)

Now i only had a quick look around but changing the password encryption would (while it probably makes sense) cause some issues:

1. how would you implement that on an existing userbase? You cannot simply convert the passwords since you only have the md5 hash.
Possible solution: You would need a function that checks if the new (whatever format) password exists. If yes it would be used for verifycation. If not it it would be generated the next time user logs in with his password.

2. MySQL supports only a limited amount of choices. E.g. SHA1 with 128-bit. And also beginning with later versions (4.0.x) which would push the XOOPS System requirements higher than they currently are. (by the way: who is still using MySql 3.x?)

And i guess there is more ...
Sorry, this signature is experiencing technical difficulties. We will return you to the sheduled signature as soon as possible ...
3
bubuche93
Re: using SHA-256 instead of md5

  • 2006/11/19 10:55

  • bubuche93

  • Just popping in

  • Posts: 25

  • Since: 2006/11/19


the stolen passwords were in md5 but it's easily decryptable !
I have a clean userbase (i had to delete all the accounts as they were compromised) so it's not a problem.
I use "MySQL client version: 4.1.20", it seems to support sha-1, it's still a bit better than md5..

Could you explain to me why we need MySQL to support sha-2? why don't we just encrypt the password in php and store it as a string in the user table?

Thanks,Buche
4
Bender
Re: using SHA-256 instead of md5

  • 2006/11/19 11:07

  • Bender

  • Home away from home

  • Posts: 1899

  • Since: 2003/3/10


Only in regards to make that change simplier.

Basicly of course: yes sure this is not dependent on MySQL.
If you want this to happen though you should make a feature request about it on the feature request tracker
Sorry, this signature is experiencing technical difficulties. We will return you to the sheduled signature as soon as possible ...
5
bubuche93
Re: using SHA-256 instead of md5

  • 2006/11/19 11:17

  • bubuche93

  • Just popping in

  • Posts: 25

  • Since: 2006/11/19


ermm i need it for tomorrow :( i have to open the site again tonight..

but i'll submit it ;)

++
Buche
6
Dave_L
Re: using SHA-256 instead of md5

  • 2006/11/19 11:39

  • Dave_L

  • XOOPS is my life!

  • Posts: 2277

  • Since: 2003/11/7


An improvement that Mithrandir and I discussed a while ago was something like this:

encrypted_password = md5(secret_key . md5(cleartext_password))

secret_key would be an installation-specific passphrase, probably defined in mainfile.php. Of course it should be suitably complex, e.g. a 64-character string of random characters

This method could be added to an existing XOOPS database, without resetting the existing passwords, since md5(cleartext_password) is what's already stored in the database.

The outer encryption wouldn't necessarily have to be md5; it could be SHA-256, if you have the code available to compute that:

encrypted_password = SHA-256(secret_key . md5(cleartext_password))
7
MadFish
Re: using SHA-256 instead of md5

  • 2006/11/19 12:58

  • MadFish

  • Friend of XOOPS

  • Posts: 1056

  • Since: 2003/9/27


Quote:
is it possible to encrypt the password using sha-256 instead of md5 in the XOOPS user table? how can i do?
md5 is VERY unsecure and my website has been hacked recently. 350+ students passwords have been stolen...


It's very unlikely that they decrypted anything. Much more likely that they ran a dictionary attack against the hashes, and that a lot of your users had chosen weak passwords. Stronger encryption won't stop this kind of attack. The solution is to force your users to choose longer and more difficult passwords.

You can set a minimum password length in the system module preferences, but at the moment I don't think there's any way to make people use difficult passwords (there was a thread on that a week or two ago though...might be worth a look).
8
bubuche93
Re: using SHA-256 instead of md5

  • 2006/11/19 13:27

  • bubuche93

  • Just popping in

  • Posts: 25

  • Since: 2006/11/19


Quote:

MadFish wrote:
Quote:
is it possible to encrypt the password using sha-256 instead of md5 in the XOOPS user table? how can i do?
md5 is VERY unsecure and my website has been hacked recently. 350+ students passwords have been stolen...


It's very unlikely that they decrypted anything. Much more likely that they ran a dictionary attack against the hashes, and that a lot of your users had chosen weak passwords. Stronger encryption won't stop this kind of attack. The solution is to force your users to choose longer and more difficult passwords.

You can set a minimum password length in the system module preferences, but at the moment I don't think there's any way to make people use difficult passwords (there was a thread on that a week or two ago though...might be worth a look).



of course, rainbow tables are much more efficient than "decrypting" the password. But there is no rainbow table for sha-2, it would take too long to generate. It takes only a few seconds to guess a 14 characters long pass in md5.
have a look at the success rate here : http://www.rainbowcrack.com/rainbowtables.php

Dave: i don't see how the secret key will improve the security, because it is stored in plaintext in mainfile.php.
Suppose the hacker finds a file include vuln. he'll be able to read the content of mainfile.php, connect to the database and find the md5 passwords no?
9
jegelstaff
Re: using SHA-256 instead of md5

  • 2006/11/20 18:23

  • jegelstaff

  • Module Developer

  • Posts: 518

  • Since: 2004/7/2 2


Quote:

bubuche93 wrote:
md5 is VERY unsecure


Just for the record, MD5 is not very unsecure. It is vulnerable to dictionary attacks and brute force attacks just like any other hashing algorithm. The quality of the passwords will determine how easily the hashing is broken more than any other factor.

MD5 is not as secure as it used to be, since the state of the art in hashing and cryptography continues to move forward. But to call MD5 very unsecure is very incorrect. Storing passwords as plaintext is very unsecure. MD5 hashes are not.

--Julian
Technical Architect - Freeform Solutions
Formulize - custom registration forms, ad hoc forms and reports
10
davidl2
Re: using SHA-256 instead of md5

  • 2006/11/20 18:34

  • davidl2

  • XOOPS is my life!

  • Posts: 4843

  • Since: 2003/5/26


MadFish wrote:
Quote:

You can set a minimum password length in the system module preferences, but at the moment I don't think there's any way to make people use difficult passwords (there was a thread on that a week or two ago though...might be worth a look).


There is a very good password hack by the author of the new banner module... I would certainly recommend you take a look at this. As has been mentioned before, most attacks are because of poor passwords... and this forces people to use a more complex password.

It's an excellent piece of work, and I hope the author submits it as a core feature.
(1) 2 »

Login

Register now!  |  Lost Password?

Search

Advanced Search

Recent Posts

Who's Online

294 user(s) are online (204 user(s) are browsing Support Forums)

Members: 0

Guests: 294

more...

Donat-O-Meter

Stats
Goal: $100.00
Due Date: Nov 30
Gross Amount: $0.00
Net Balance: $0.00
Left to go: $100.00
Make donations with PayPal!

Latest GitHub Commits