[Date Prev][Date Next]
[Chronological]
[Thread]
[Top]
RE: Antw: use openssl or moznss for more than TLS?
Thanks for the reply, Ulrich. What I'm trying to do is meet a customer requirement :-)
We are using {SSHA} (SHA-1) in OpenLDAP now. The customer wants SHA-512. And they require a FIPS-validated implementation, which I think narrows our options to using either OpenSSL or NSS in FIPS mode. I cannot see a better way to meet the customer's two requirements than gutting pw-sha2 and using that as a thin wrapper for the raw crypto functions in either openssl or nss.
I'm hoping somebody can suggest a better solution.
Steve
-----Original Message-----
From: Ulrich Windl [mailto:Ulrich.Windl@rz.uni-regensburg.de]
Sent: Friday, October 25, 2013 1:02 AM
To: Steve Eckmann; openldap-technical@openldap.org
Subject: Antw: use openssl or moznss for more than TLS?
>>> Steve Eckmann <steve.eckmann@issinc.com> schrieb am 25.10.2013 um
>>> 04:08 in
Nachricht
<1cc760ef909d438ab78baff3ff7547b1@CO1PR04MB442.namprd04.prod.outlook.com>:
> We need a FIPS-validated SHA512 for password storage. The pw-sha2
> module provides SHA512 but isn't FIPS-validated. I see that I can use
> openssl or moznss in FIPS mode to get TLS, but I don't see how to get
> to either of those library's crypto functions from openldap. Is it possible?
Hi!
I don't know what you wnat to do, but user's passwords will be significantly weaker than SHA-1 I guess. The only thing is that some algorithms use more random bits for the salt, so the new security actually comes from mor salt, not from longer hashes. Still common passwords (from a dictionary) are problematic...
Like this (both passwords are identical):
mOH0vXSTP9b9c (DES, UNIX standard)
$6$rF2.bjfmxyctx3d2$7pJwHFCgsJPD/nwoA4kUm2aykwpWs3VUO5zZrQzEVWEqgGM0.qSvzkP3fsaJXrDCgjQvw454DkPYAh6Z/BD/p1 (SHA-512)
Regards,
Ulrich
>
> Thanks.
>
> Steve