[cas-dev] How are the hashes salted, or, does anyone use salted digests as passwords?

[Graham Bakay]

Hello, everyone.

Here's a question regarding the JDBC adaptor classes.

Our passwords are stored in a Salted SHA digest. The salt is random and
appended (in plaintext) to the SHA hash to make the digest. Therefore,
in order to encode a supplied password to compare against the stored
password, we need to grab the stored password and determine the salt
that was used to encode it. This is easily done since it is appended in
plaintext to the end of the hash.

The PasswordEncoder.encode() interface only allows the one parameter.
For the supplied implementations, what is used as the salt when
encoding? Ideally for us the PasswordEncoder.encode() interface would
allow a two parameter method which could take the string to encode and
the salt to encode with. With that, we could implement the
PasswordEncoder interface, and potentially extend it to use a
SaltGenerator-type class/interface that could either take a static salt,
or retrieve it from the digest as we do.

I'd love to get some feedback. Right now, we essentially will have to
ignore the PasswordEncoder and do the steps (retrieve the stored
password, get the salt it was hashed with, hash the supplied password,
compare the two results) manually in
authenticateUsernamePasswordInternal(). Maybe that's what we're supposed
to do, but I thought I'd ask to see if anyone else uses salted hashes
and could see this usage being rolled into the core (or at least as an
adaptor).

Our implementation of SSHA is directly out of paper "Salted Hashes
Demystified" by A. Andreu available from www.oswap.org.

Cheers!

Graham Bakay
Programmer Analyst
Information Technology Services
Edmonton Public Schools
http://www.epsb.ca/
One Kingsway NW
Edmonton, Alberta  T5H 4G9
Office: (780) 429-8236
Fax: (780) 448-0499
Email: graham.bakay at epsb.ca