Re: [Firebird-devel] Insecure hashing and encryption in Firebird 3

[Jim S. <ji...@ji...>]

On 7/27/2015 8:35 AM, Alex Peshkoff wrote:
> On 07/26/2015 10:36 PM, Jim Starkey wrote:
>
>> The bottom line is this:  If you are going to change the password hash,
>> you are going to invalidate all existing passwords.  But rather than
>> start over with an already flawed architecture, punt on storing
>> passwords at all and go exclusively with SRP.
> When I've said that SHA1 hashes are stored in security database, I've
> meant exactly SRP verifiers. SHA1 is used for calculation of SRP
> verifier, and this is the only result of SHA1 stored in the database.

That is as it should be.  But as I said before, SHA-1 in SRP is used 
only to turn a known Bignum (which has many poor characteristics for an 
encryption key) into a 20 byte vector usable as a robust encryption key.
>
> BTW, except invalidation of all existing passwords this step also
> invalidates all old clients, including Java and C# clients, not using
> fbclient library. And it's hard to say what is worse.
>
And for nothing to be gained...

By the way, for those souls deeply concerned about accidental SHA-1 
password collisions, the probability is 1 in 2^159 as the weaknesses of 
SHA-1 don't affect this problem.  And despite the academic "weakness" of 
SHA-1, according to Wikipedia, nobody to date has found a SHA-1 
collision, accidentally or intentionally.

Question: Does Firebird detect, report, and shutdown repetitive attacks 
on passwords?