[TYPO3-core] RFC #13754: Secure Install Tool Login

[Sigfried Arnold]

Am 06.03.2010 21:53, schrieb Marcus Krause:
> We might consider storing the install tool password as sha1 hash in
> localconf. But that's all I would do in regards to security improvements.

I agree to switch to a stronger hash algorithm, but lets switch to 
SHA-256 then. SHA-1 familiy already considered as broken (but in a term, 
that won't apply to password security).

But for the Protocol: this won't provide any extra security - even if 
you use a SHA-512 hash. Neither MD5 nor SHA-1 has any practical useable 
security issue for a preimage attack (getting any possible plaintext for 
a given hash).

A 'stronger' hash algorithm only spreads the spectrum and makes it more 
time intense to get a possible plain text for a definied hash by using 
brute force methods - but all that extra time is worth nothing if the 
attacker simply uses a pre rendered rainbow table or attacks via 
dictionary. The best hash algorithm won't here help if the password is 
simply stupid (example A-Za-z0-9, lenght <= 16)[1]. There are tons of 
tools for creating rainbow or dictionary tables out there - and of 
course online - you can even use google as cracking tool by simply 
googling a hash.

regards
Sigfried Arnold

[1] Example: <= 8 length with 62 possible charaters are around 
2.18x10^14 possible psswords, MD5 already got theroreticaly 3.4x10^38 
possible hashes. You don't even get close to this with such lousy 
password - so why use SHA-1 with 1.46x10^48 possible hashes?

Just make sure (or suggest), people use longer install tool passwords - 
for example: print out a warning if the entered password is <= 16 
characters.