OPNsense Forum

Archive => 21.1 Legacy Series => Topic started by: seed on March 06, 2021, 12:29:20 pm

Title: Passwords stored as Blowfish in Config file
Post by: seed on March 06, 2021, 12:29:20 pm

While working in the Config XML i found that passwords are stored as Blowfish. Why are Passwords not stored as SHA-512?
SHA-512 should be standard. Even the root users PW ist stored as Blowfish.

Extract from Config File:

    <user>
      <password>$2y$10$################################</password>
      <scope>users</scope>
      <name>testusername</name>
      <descr>test test</descr>
      <expires/>
      <authorizedkeys/>
      <ipsecpsk/>
      <otp_seed/>
      <uid>12345</uid>
      <cert>############</cert>
      <cert>############</cert>
    </user>

Title: Re: Passwords stored as Blowfish in Config file
Post by: chemlud on March 06, 2021, 12:39:49 pm

Hmmm, or bcrypt, maybe?

https://en.wikipedia.org/wiki/Bcrypt

Title: Re: Passwords stored as Blowfish in Config file
Post by: Patrick M. Hausen on March 06, 2021, 01:14:04 pm

What's the problem with Blowfish?

Title: Re: Passwords stored as Blowfish in Config file
Post by: chemlud on March 06, 2021, 01:15:03 pm

https://www.cloudsecuretech.com/a-look-at-some-encryption-algorithms-used-over-the-years/

Title: Re: Passwords stored as Blowfish in Config file
Post by: Patrick M. Hausen on March 06, 2021, 01:20:18 pm

So?

Quote

Blowfish was designed by Bruce Schneier in 1993 and uses symmetric encryption. It has a variable key length from 32 bits to 448 bits and uses a 64-bit block cipher.

Although it still remains widely in use, AES is treated as the standard encryption method. It is also unpatented and royalty free and hence available for all users.

Since it uses a 64-bit block cipher, it is not recommended to use Blowfish encryption on file sizes larger than 4gb. In fact, Schneier himself recommends using Twofish encryption instead.

There is no weakness mentioned in that article ...

Blowfish has been available as a secure password hash algorithm in FreeBSD  for years and works.

Title: Re: Passwords stored as Blowfish in Config file
Post by: marjohn56 on March 06, 2021, 01:26:18 pm

Unless your password is more than 4Gb in length, then it could be a problem. 8)

Title: Re: Passwords stored as Blowfish in Config file
Post by: schnipp on March 06, 2021, 06:32:30 pm

Quote from: seed on March 06, 2021, 12:29:20 pm

While working in the Config XML i found that passwords are stored as Blowfish. Why are Passwords not stored as SHA-512?
SHA-512 should be standard. Even the root users PW ist stored as Blowfish.

Extract from Config File:

    <user>
      <password>$2y$10$################################

What is the real problem? Conducting the man page "$2y" means bcrypt. Bcrypt is not the same like Blowfish, even if the former is derived from it. As far as I know, Bcrypt is still considered secure for password based authentication. Correct me if I am wrong.

Furthermore, it does not make sense only comparing the entropy of hash functions when used for password based authentication schemes.

Title: Re: Passwords stored as Blowfish in Config file
Post by: Patrick M. Hausen on March 06, 2021, 06:59:52 pm

Quote from: schnipp on March 06, 2021, 06:32:30 pm

What is the real problem? Conducting the man page "$2y" means bcrypt. Bcrypt is not the same like Blowfish, even if the former is derived from it. As far as I know, Bcrypt is still considered secure for password based authentication. Correct me if I am wrong.

Furthermore, it does not make sense only comparing the entropy of hash functions when used for password based authentication schemes.

bcrypt is a password-hashing function designed by Niels Provos and David Mazières, based on the Blowfish cipher ...
(Wikipedia)

Of course Blowfisg being a symmetrical cypher and not a hash funktion like SHA you need to design a specific password hash mechanism to use it as such. Same as with DES or AES ...

Title: Re: Passwords stored as Blowfish in Config file
Post by: franco on March 06, 2021, 07:49:40 pm

Less drama and more reasonable GitHub requests please. It's not an issue to change it, but I am a bit weary of "OH MY GOD WHAT IS WRONG WITH YOU PEOPLE" approach in recent reports. ;)


Cheers,
Franco

Title: Re: Passwords stored as Blowfish in Config file
Post by: fabian on March 07, 2021, 09:25:10 am

Bcrypt is still fine and the alternative is definitely not SHA. The alternatives to Bcrypt would be scrypt and argon2.

One advantage of Bcrypt is that it is widely supported.