TheArchive/zitadel
1
0
Fork 0
mirror of https://github.com/zitadel/zitadel.git synced 2025-08-11 21:37:32 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(crypto): support md5 salted for imported password hashes (#9596)

Browse Source 
# Which Problems Are Solved

Allow verification of imported salted passwords hashed with plain md5.

# How the Problems Are Solved

- Upgrade passwap to
[v0.7.0](https://github.com/zitadel/passwap/releases/tag/v0.7.0)
- Add md5salted as a new verifier option in `defaults.yaml`

# Additional Changes

- go version and libraries updated  (required by passkey v0.7.0)
- secrets.md verifiers updated  
- configuration verifiers updated 
- added MD5salted and missing MD5Plain to test cases
This commit is contained in:
Miro Trisc
2025-03-21 13:25:52 +01:00
committed by GitHub
parent dc64e35128
commit e4c12864e5
6 changed files with 70 additions and 32 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
internal/crypto/passwap.go
View File

@@ -12,6 +12,7 @@ import (
"github.com/zitadel/passwap/bcrypt"
"github.com/zitadel/passwap/md5"
"github.com/zitadel/passwap/md5plain"
"github.com/zitadel/passwap/md5salted"
"github.com/zitadel/passwap/pbkdf2"
"github.com/zitadel/passwap/scrypt"
"github.com/zitadel/passwap/verifier"
@@ -43,14 +44,15 @@ func (h *Hasher) EncodingSupported(encodedHash string) bool {
type HashName string
const (
HashNameArgon2 HashName = "argon2" // used for the common argon2 verifier
HashNameArgon2i HashName = "argon2i" // hash only
HashNameArgon2id HashName = "argon2id" // hash only
HashNameBcrypt HashName = "bcrypt" // hash and verify
HashNameMd5 HashName = "md5" // verify only, as hashing with md5 is insecure and deprecated
HashNameMd5Plain HashName = "md5plain" // verify only, as hashing with md5 is insecure and deprecated
HashNameScrypt HashName = "scrypt" // hash and verify
HashNamePBKDF2 HashName = "pbkdf2" // hash and verify
HashNameArgon2 HashName = "argon2" // used for the common argon2 verifier
HashNameArgon2i HashName = "argon2i" // hash only
HashNameArgon2id HashName = "argon2id" // hash only
HashNameBcrypt HashName = "bcrypt" // hash and verify
HashNameMd5 HashName = "md5" // verify only, as hashing with md5 is insecure and deprecated
HashNameMd5Plain HashName = "md5plain" // verify only, as hashing with md5 is insecure and deprecated
HashNameMd5Salted HashName = "md5salted" // verify only, as hashing with md5 is insecure and deprecated
HashNameScrypt HashName = "scrypt" // hash and verify
HashNamePBKDF2 HashName = "pbkdf2" // hash and verify
)
type HashMode string
@@ -119,6 +121,10 @@ var knowVerifiers = map[HashName]prefixVerifier{
prefixes: []string{pbkdf2.Prefix},
verifier: pbkdf2.Verifier,
},
HashNameMd5Salted: {
prefixes: []string{md5salted.Prefix},
verifier: md5salted.Verifier,
},
}
func (c *HashConfig) buildVerifiers() (verifiers []verifier.Verifier, prefixes []string, err error) {