RE: [Dnfbb-developers] Password Encryption/Complexity

[<dnf...@li...>]

 

> -----Original Message-----
> Here is a link to a website which shows the available 
> encryption algorithms etc that can be supported out of the 
> box on mysql.

At the moment I was thinking of using MD5, which is available via UDF for
Firebird.  This shouldn't stop us planning future works and implementing
stubs, of which you could quite easily implement now within the MySQL board.

> I would try and build in the potential for supporting other 
> methods of encryption when creating the function so hopefully 
> you don't need to go back and rework the function interface 
> only the content of the function (Even create dummy stubs 
> ready for quick implementation.).  One thing I think we 
> should add is a "Salt" column to the user table.  If you do a 
> search on the page attached you will find an example of what 
> needs to be done.  
>  

Agreed, ive added a SALT column to users table, along with a domain and a
couple of triggers to auto populate it with the current time stamps seconds.

> I am not sure what other algorithms are available on 
> Firebird.  It looks like SH1 is coming to firebird 2 so it 
> depends on which release you are running on.  Whilst we are 
> adding them why not add them straight off?  I would be 
> tempted to put in the ones which are available on both 
> systems for now.

Unfortunately SH1 is for the master username database (security.fdb) only, I
have found a UDF for MD5 (rFunc) which I will implement asap.

>  
> Again I would build into the interface the ability for a 
> complexity check and then create a blank function to handle 
> this outside of the main password function.  You can even put 
> the function calls in but just return true for the time being 
> in the complexity check function.  We can then look at adding 
> the functionality for a complexity check at a later date.

Agreed, whats the best way to go around doing this?  I am in favour of
adding the encryption type in DNFBB_SETTINGS, along with the key, if the
encryption needs a key, perhaps a lookup where 1 = MD5, 2 = SH1 etc etc, or
even store the name of the stored proc that is used to encrypt within the
settings table, for firebird this could be DNFI_ENCRYPT_MD5 or
DNFI_ENCRYPT_SH1.

Any help/ideas/thoughts on implementation would appreciated.

Rgds

Si