commit ed1e31eca6cd34677feb6674973c4f8989b2b4e4
Author: Brant Knudson <email address hidden>
Date: Sat Aug 23 11:35:25 2014 -0500
Configurable token hashing algorithm
The user's authentication token was hashed using the MD5 algorithm.
The MD5 algorithm shouldn't be used because of the potential for
hash collisions. Some security standards mandate a SHA2 algorithm
or better must be used.
With this change the algorithm to use for hashing tokens can be
configured by setting the OPENSTACK_TOKEN_HASH_ALGORITHM
configuration option to a hash algorithm supported by Python's
hashlib library[1]. For example, a deployer could set the option to
'sha256' to meet a SHA2 security standard.
The algorithm chosen must match the hash algorithm that the
identity server is configured to use (Keystone and the auth_token
middleware can be configured to use any hash algorithm supported by
hashlib).
Reviewed: https:/ /review. openstack. org/116509 /git.openstack. org/cgit/ openstack/ django_ openstack_ auth/commit/ ?id=ed1e31eca6c d34677feb667497 3c4f8989b2b4e4
Committed: https:/
Submitter: Jenkins
Branch: master
commit ed1e31eca6cd346 77feb6674973c4f 8989b2b4e4
Author: Brant Knudson <email address hidden>
Date: Sat Aug 23 11:35:25 2014 -0500
Configurable token hashing algorithm
The user's authentication token was hashed using the MD5 algorithm.
The MD5 algorithm shouldn't be used because of the potential for
hash collisions. Some security standards mandate a SHA2 algorithm
or better must be used.
With this change the algorithm to use for hashing tokens can be TOKEN_HASH_ ALGORITHM
configured by setting the OPENSTACK_
configuration option to a hash algorithm supported by Python's
hashlib library[1]. For example, a deployer could set the option to
'sha256' to meet a SHA2 security standard.
The algorithm chosen must match the hash algorithm that the
identity server is configured to use (Keystone and the auth_token
middleware can be configured to use any hash algorithm supported by
hashlib).
This is for security hardening.
[1] https:/ /docs.python. org/2/library/ hashlib. html
DocImpact
SecurityImpact
Change-Id: I9e3eba7e0a12ae 40a08d0ed851ea9 16ec6591bcc
Closes-Bug: #1174499