RE: [Dnfbb-developers] Password Encryption/Complexity

[<dnf...@li...>]

Hello,
=20
Here is a link to a website which shows the available encryption =
algorithms etc that can be supported out of the box on mysql.
=20
http://dev.mysql.com/doc/refman/5.0/en/encryption-functions.html
=20
I would try and build in the potential for supporting other methods of =
encryption when creating the function so hopefully you don't need to go =
back and rework the function interface only the content of the function =
(Even create dummy stubs ready for quick implementation.).  One thing I =
think we should add is a "Salt" column to the user table.  If you do a =
search on the page attached you will find an example of what needs to be =
done. =20
=20
I am not sure what other algorithms are available on Firebird.  It looks =
like SH1 is coming to firebird 2 so it depends on which release you are =
running on.  Whilst we are adding them why not add them straight off?  I =
would be tempted to put in the ones which are available on both systems =
for now.
=20
Again I would build into the interface the ability for a complexity =
check and then create a blank function to handle this outside of the =
main password function.  You can even put the function calls in but just =
return true for the time being in the complexity check function.  We can =
then look at adding the functionality for a complexity check at a later =
date.
=20
Just some thoughts on the email below:
=20
Simon

________________________________

From: dnf...@li... =
[mailto:dnf...@li...]
Sent: Wed 18/01/2006 11:39 PM
To: dnf...@li...
Subject: [Dnfbb-developers] Password Encryption/Complexity



I have created an internal stored proc for password =
encryption/complexity
(below), Initially I was thinking of using MD5 hash with the posibility =
of
adding other hash methods defined by board admin later.  I was also
wondering if we should enforce minimum length and complexity for =
password.

Does anybody have any thoughts on this?  Should I just add MD5 hashing =
now
and leave complexity and other hashing methods till after version 1.0?

Rgds

Si


CREATE OR ALTER PROCEDURE DNFI_ENCRYPT_PASSWORD(ipPASSWORD VARCHAR(100))
RETURNS (opPASSWORD VARCHAR(100))
AS
BEGIN
  /* TODO Validate password for length and complexity? maybe */
  IF ((ipPASSWORD IS NULL) OR (ipPASSWORD =3D '')) THEN
    EXCEPTION EXC_DNF_INVALID_PASSWORD;

  /* TODO Encrypt and return the password */
=20
  /* Return the encrypted password */
  opPASSWORD =3D ipPASSWORD;
  SUSPEND;
END ##



-------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc. Do you grep through log =
files
for problems?  Stop!  Download the new AJAX search engine that makes
searching your log files as easy as surfing the  web.  DOWNLOAD SPLUNK!
http://sel.as-us.falkag.net/sel?cmd=3Dlnk&kid=3D103432&bid=3D230486&dat=3D=
121642
_______________________________________________
Dnfbb-developers mailing list
Dnf...@li...
https://lists.sourceforge.net/lists/listinfo/dnfbb-developers