My application can authenticate via openid and oauth (facebook, twitter, etc) and also with its own authentication system. I previously switched hashing from MD5 to SHA1 and during migration I had to customize so that accounts could verify both with MD5 and SHA1 and now I've removed the MD5 completely.
I read here somewhere that for passwords in fact SHA1 should not be used and bcrypt or something else instead since SHA1 is not specifically a password algorithm and instead is a hash function implementation while a password algorithm would have other more specific features. Can you tell me more about this? Should I switch from SHA1, is it important or premature / paranoia since I never even had a production security issue that I know? I can think of some possible actions:
- Staying with the current implementation (SHA1 and salt) since the main function of my service isn't user accounts anyway
- Passing the algorithm as a parameter to the encryption and thus being able to authenticate with different and new algorithm i.e. now using SHA1 and later its easy to switch
- Become an OAuth provider and then being able to add ourselves just like we add twitter, facebook and other OAuth providers
Does the issue of "real" and "fake" salt mean a lot in practice or just for highest security? Am I using real or fake salt in detail, when the following is the implementation:
def __encrypt(self, plaintext, salt=""): """returns the SHA1 hexdigest of a plaintext and salt""" phrase = hashlib.sha1() phrase.update("%s--%s" % (plaintext, salt)) return phrase.hexdigest() def set_password(self, new_password): """sets the user's crypted_password""" import datetime if not self.salt: self.salt = self.__encrypt(str(datetime.datetime.now())) self.crypted_password = self.__encrypt(new_password, self.salt) def check_password(self, plaintext): return self.__encrypt(plaintext, self.salt) == self.crypted_password
Please tell me if you can comment.