[Owncloud] Salt

[Thomas Tanghus]

On Friday 08 June 2012 11:41 Andreas Schneider wrote:
> On Friday 08 June 2012 10:40:57 Thomas Tanghus wrote:
> > On Friday 08 June 2012 10:15 Andreas Schneider wrote:
> > > You know there is this rocket sience technology from the 70ies. It is
> > > called salt in cryptography. I suggested several times to use salting in
> > > owncloud but we still don't have it.
> > > 
> > > First linkedin:
> > > http://www.h-online.com/security/news/item/LinkedIn-confirms-that-user-
> > > passwords-were-compromised-1612554.html
> > > 
> > > then last.fm:
> > > http://www.lastfm.de/passwordsecurity
> > > 
> > > 
> > > next: your owncloud installation ...
> > 
> > Now I don't know much about cryptography, but I read the code, followed
> > the
> > password, and to me it looks like you're spreading FUD:
> > 
> > https://gitorious.org/owncloud/owncloud/blobs/master/3rdparty/phpass/Passw
> > or dHash.php#line208
> 
> Sorry, you're right.
> 
> $2a$08$lh85qKaF6CVi.azfbThI4.qbLZK9vw0XaLHWr616JbH...
> 
> looks like the first part is the random salt and the second is the hash, but
> why isn't simply bcrypt used?

As far as I understand phpass implements bcrypt if it is not available:
http://www.openwall.com/phpass/

-- 
Med venlig hilsen / Best Regards

Thomas Tanghus