9

A GitHub project I recently checked has a flawed security as they're using an unsalted md5() to hash the passwords. I opened a bug and they acknowledged it. However, the transition from md5() to bcrypt would mean that every user would need to log in so the password can be migrated.

So my question is, does using bcrypt over md5() reduce it's security?

// For already logged in users:
if (password_verify(md5($_POST['pass']), $DBHash)) {

  }

In that way, the whole database could be migrated easily, instead of migrating each user individually.

Should there be any other problem besides the fact that PHP might timeout if not handled correctly? (around 1 second for each hash).

|improve this question
  • 3
    1 sec per hash is too much for server side hashing. Makes it trivial to DoS your site. I recommend values between 10ms and 100ms. – CodesInChaos Nov 22 '13 at 12:29
  • I was just learning about securing the users but never really about securing my site. That's a great piece of advice, thank you @CodesInChaos – Francisco Presencia Nov 22 '13 at 12:36
15

Absolutely not. In fact, this is almost the standard procedure for migration from a weak hashing scheme to bcrypt in every project I worked with.

What usually happens is that a flag is set for each user indicating that their passwords use the old scheme, and whenever they login the application uses the backward-compatible login logic. Once the user logs in, you have their plaintext password, and now you can simply take the new password and store it using bcrypt only, the unset the flag. All new users use the new bcrypt-only scheme.

Alternatively, you can go by CodesInChaos's suggestion and stick to the new bcrypt(md5()). While he's indeed correct that there's no security gain, I personally like to keep it bcrypt() only.

|improve this answer
  • Why would you prompt users to change the password? You already have the plaintext since the user just logged in. – CodesInChaos Nov 22 '13 at 12:31
  • 3
    Personally I probably wouldn't even bother going from bcrypt(md5(pass), salt) to pure bcrypt(pass, salt). There is practically no security gain. – CodesInChaos Nov 22 '13 at 12:33
  • I consider the correct answer yours, @Adnan, but only after complementing it with the one from CodesInChaos. – Francisco Presencia Nov 22 '13 at 12:43
  • 1
    @CodesInChaos (about 1st comment), there's a point as it theoretically could already have been leaked. About 2nd, that was the actual point of my question, if there was any actual gain from using only bcrypt(pass) over bcrypt(md5(pass)) (note bcrypt auto-generates a salt, so it's okay not to pass it). – Francisco Presencia Nov 22 '13 at 12:46
  • Actually, there is a benefit to using bcrypt(md5()). While MD5 has no practical limit to the input size, bcrypt is limited to 72 bytes, iirc. Chaining the two allows bcrypt to take effectively unlimited password sizes. – forest Apr 3 '16 at 6:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.