Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

A GitHub project I recently checked has a flawed security as they're using an unsalted md5() to hash the passwords. I opened a bug and they acknowledged it. However, the transition from md5() to bcrypt would mean that every user would need to log in so the password can be migrated.

So my question is, does using bcrypt over md5() reduce it's security?

// For already logged in users:
if (password_verify(md5($_POST['pass']), $DBHash)) {

  }

In that way, the whole database could be migrated easily, instead of migrating each user individually.

Should there be any other problem besides the fact that PHP might timeout if not handled correctly? (around 1 second for each hash).

share|improve this question
2  
1 sec per hash is too much for server side hashing. Makes it trivial to DoS your site. I recommend values between 10ms and 100ms. –  CodesInChaos Nov 22 '13 at 12:29
    
I was just learning about securing the users but never really about securing my site. That's a great piece of advice, thank you @CodesInChaos –  Francisco Presencia Nov 22 '13 at 12:36
add comment

1 Answer 1

up vote 12 down vote accepted

Absolutely not. In fact, this is almost the standard procedure for migration from a weak hashing scheme to bcrypt in every project I worked with.

What usually happens is that a flag is set for each user indicating that their passwords use the old scheme, and whenever they login the application uses the backward-compatible login logic. Once the user logs in, you have their plaintext password, and now you can simply take the new password and store it using bcrypt only, the unset the flag. All new users use the new bcrypt-only scheme.

Alternatively, you can go by CodesInChaos's suggestion and stick to the new bcrypt(md5()). While he's indeed correct that there's no security gain, I personally like to keep it bcrypt() only.

share|improve this answer
    
Why would you prompt users to change the password? You already have the plaintext since the user just logged in. –  CodesInChaos Nov 22 '13 at 12:31
2  
Personally I probably wouldn't even bother going from bcrypt(md5(pass), salt) to pure bcrypt(pass, salt). There is practically no security gain. –  CodesInChaos Nov 22 '13 at 12:33
    
I consider the correct answer yours, @Adnan, but only after complementing it with the one from CodesInChaos. –  Francisco Presencia Nov 22 '13 at 12:43
1  
@CodesInChaos (about 1st comment), there's a point as it theoretically could already have been leaked. About 2nd, that was the actual point of my question, if there was any actual gain from using only bcrypt(pass) over bcrypt(md5(pass)) (note bcrypt auto-generates a salt, so it's okay not to pass it). –  Francisco Presencia Nov 22 '13 at 12:46
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.