[TYPO3-project-4-3] saltedpasswords for v4.3

[Fernando Arconada]

Why md5? md5 isnt secure now even sha1 are going to fail soon but it is 
better than md5
The better (most secure) hash system now is sha1 (or sha256) + ripemd-160

sha1(hash("ripemd160", $password));



El Thu, 18 Jun 2009 10:19:48 +0200, Steffen Ritter escribió:

> Hi folks,
> 
> we finished "saltedpasswords" rewrite as sysext for TYPO3 4.3... We need
> you to test it on other systems. You'll find it at
> 	https://svn.typo3.org/TYPO3v4/Extensions/t3sec_saltedpw/trunk
> attached is current T3X for easy testing...
> 
> Some facts:
> - on first login "oldformat" passwords are converted to salted if
> "updatePasswd" is set (standard).
> - Extension works on security levels "normal" and "rsa" in fe, for be
> you have to use "rsa" for security reasons... - You can choose between
> using blowfish  and md5 to crypt your hash. Currently this might be
> risky since there is no real portability since blowfish not avaliable on
> every server... Since php 5.3 a own blowfish build in library will be
> shipped which everytime will be used at fallback if no syslib is
> installed.
> - We changed Hash-Format from a lib PHPasswd to a "generalized" and
> really "portable" format, which will allow you to use TYPO3 user db for
> other services (f.e.: smtp/pop3/imap-server, linux-login, samba shares
> (even in windows over ldap), nfs/printerservices). The PHPasswd format
> MAY be recognized if the old extension is available in ext-folder (not
> installed) and "handleOldFormat" is set
> 
> 
> Following things we are currently awaiting (you cannot test yet):
>   - user creation in admin panel does hardcoded md5, so be shure not to
> enable "forceSalted", which would only allow salted formats... I will
> provide a patch within the next days, as soon as we have this ext in.
>   - the user setup Module has currently md5 hardcoded, Steffen Kamper
> provided a patch, which allows to register your eval functions via Hook,
> I attached this too...
>   - for felogin "send new password" we are awaiting the patches in core
> list to use the hook which is introduced there...
> 
> 
> regards
> 
> Steffen
> Index: typo3/sysext/setup/mod/index.php
> =================================================================== ---
> typo3/sysext/setup/mod/index.php	(revision 5584) +++
> typo3/sysext/setup/mod/index.php	(working copy) @@ -177,15 +177,22 
@@
>  			$this->PASSWORD_UPDATED =
>  			strlen($be_user_data['password'].$be_user_data
['password2'])>0 ? -1
>  			: 0; if ($be_user_data['email']!=$BE_USER->user
['email']
>  					|| $be_user_data['realName']!=
$BE_USER->user['realName']
> -					|| (strlen($be_user_data
['password'])==32 +					|| (
> (strlen($be_user_data['password'])==32 ||
> (isset($columns['password']['eval']) &&
> strpos($columns['password']['eval'], '->')))
>  							&&
>  							!strcmp
($be_user_data['password'],$be_user_data['password2']))
>  					)	{
>  				$storeRec = array();
>  				$BE_USER->user['realName'] =
>  				$storeRec['be_users'][$BE_USER->user
['uid']]['realName'] =
>  				substr($be_user_data['realName'],0,80); 
$BE_USER->user['email'] =
>  				$storeRec['be_users'][$BE_USER->user
['uid']]['email'] =
>  				substr($be_user_data['email'],0,80);
> -				if (strlen($be_user_data['password'])==32 
&&
> !strcmp($be_user_data['password'],$be_user_data['password2']))	
{ -				
> $BE_USER->user['password'] =
> $storeRec['be_users'][$BE_USER->user['uid']]['password'] =
> $be_user_data['password2']; +
> +				if (isset($columns['password']['eval']) &&
> strpos($columns['password']['eval'], '->')) 
{ +					$parts =
> explode('->', $columns['password']['eval']); 
+				
> $storeRec['be_users'][$BE_USER->user['uid']]['password'] =
> call_user_func(array($parts[0], $parts[1]), $be_user_data['password2']);
>  					$this->PASSWORD_UPDATED = 1;
> +				} else {
> +					if (strlen($be_user_data
['password'])==32 &&
> !strcmp($be_user_data['password'],$be_user_data['password2']))	
{ +					
> $BE_USER->user['password'] =
> $storeRec['be_users'][$BE_USER->user['uid']]['password'] =
> $be_user_data['password2']; +						
$this->PASSWORD_UPDATED = 1;
> +					}
>  				}
>  
>  					// Make instance of TCE for 
storing the changes.