> On 12 Jan 2024, at 11:21, John Thurston <john.thurston@alaska.gov> wrote:
>
> Excellent, thank you very much, William!
> But know that I've read that, I think I'll want to start with the underscore-implementation. That should result in ldifs from my DS 2.1 which I could, if needed, use with my DS 1.4 instance. This isn't a long-term setting, just a migration step until we turn off 1.4.
That's fine - it's what the "upgrade on bind" feature is for. Once you finish your migration, you change the default pw scheme in dse.ldif and then on bind it transparently upgrades the hash format.
> At that time, we'll step 2.1 up to SHA512 and duck the whole -/_ thing.
You should use PBKDF2-SHA256 here, not SHA512. Big number != more securerer. The benefit of PBKDF2 is that it many rounds which forces an attacker to do a lot of work. SHA256 is a secure hash here, so you dont practically gain anything by choosing PBKDF2-SHA512 over PBKDF2-SHA256 - they both will end up targeting and achieving the same work factor. Worst case you actually end up less secure if you have a CPU that *doesn't* have hardware accelerated SHA512. This will force fewer rounds as a result, where SHA256 could achieve more rounds because your CPU has hwaccel for the algo. NIST still recommend PBKDF2-SHA256 here as well.
If you don't have FIPS requirements, consider argon2 instead as it's memory hard as well as cpu hard.
--
Sincerely,
William Brown
Senior Software Engineer,
Identity and Access Management
SUSE Labs, Australia
--
_______________________________________________
389-users mailing list -- 389-users@lists.fedoraproject.org
To unsubscribe send an email to 389-users-leave@lists.fedoraproject.org
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/389-users@lists.fedoraproject.org
Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
No comments:
Post a Comment