callumacrae wrote:What about updates? The new function will have to have a way o knowing whether it is the old or new password, and then check against the respective method and update the password if it is the old one.
This code will have to stay in phpBB forever, unless the board deactivates their account or something for 4.0.
Not really. We can use both password cores simultaneously.
We just need to update to the new hash when the user logs in.
I already did this in a previous project when I was updating from md5 to sha-1. It worked like this:
During updating sequence:
Update the table to accommodate the bigger hash.
Delete all sessions (logout everyone).
During a login:
Load the (hashed) password from the DB.
Check the hash size. If it corresponds to the size of a md5 hash, execute the input password as an md5 hash, else execute as a sha-1 hash.
If it executed as a md5 hash, update the table with the sha-1 hash.
6 months later:
This transitional feature is removed. If someone wanted to get the account back, he/she will need to use the password recovery system.
This worked for that specific program. Do you see any faults in it?
In a conversation with Oleg, this was brought up and produced this response:
- Code: Select all
[10:12] <aw-> we already handle this better
[10:12] <aw-> the way you handle that is
[10:12] <aw-> 1. expand tables
[10:12] <aw-> 2. implement new hashes
[10:12] <aw-> 3. make sure you can still authenticate against old hashes (i.e. don't remove the old code)
[10:13] <aw-> you need to embed what kind of hash it is into the hash for this to work
[10:13] <aw-> e.g. if you look at our hashes they begin with $X$ or similar
[10:13] <aw-> X tells you what type of hash it is
[10:13] <aw-> 4. when a user successfully logs in, you know their password
[10:13] <aw-> this is when you check if the hash is using the old hashing algorithm
[10:14] <aw-> if it is, you rehash the password using the new algorithm and write it to the db
[10:14] <aw-> i believe this is how we went from simple md5 in phpbb2 to the current salted md5 in phpbb3
[10:14] <aw-> and this discussion should not be private
[10:14] <aw-> please post the log in the topic when we're done
