support alternative password hashing in keystone

[Morgan Fainberg]

Once upon a time there was bug #862730 recommending that alternative password hashing be supported which was closed as invalid since hashing became base-line feature of Keystone's passwords. It would be generally beneficial to support at the very least the passlib implementation of bcrypt as an alternative to strictly sha512 based password hashing. Ideally this should also take into account the relatively new player scrypt.

NIST has standardized (afaict) on the SHA-2 based hashing, which should remain the default. Architecture that will support some different password hashing made available at least through passlib will make keystone better in the long term, allowing for operators to determine more than just the SHA-2 based cost.

The proposal is as follows:

  * Allow selected support of different password hashing algorithms from with passlib architecturally

  * Expand to support bcrypt

  * Deprecate the "crypt_strength" option in favor of identifying the cost when selecting the password hashing algorithm such as: sha512::10000 or bcrypt::12

  * Keep the default the same as today

  * Identify the password hash based upon the algorithm used, no identifier = sha512 (this might not be required)

  * Add "py-bcrypt" or similar "preferred" backend(s) to extras in setup.cfg

[Morgan Fainberg (mdrnstm)]

Set this as wishlist as it would be at best a nice-to-have.

[Morgan Fainberg (mdrnstm)]

I would have included scrypt support as a "nice to have" as part of the proposal as well, but passlib does not currently implement scrypt and I expect we should maintain a single library for password hashing for code maintenance/supportability reasons.

[Jeremy Stanley (fungi)]

There's nothing wrong with using SHA-2/512, AS LONG as you use it in a key derivation function (you really just shouldn't use the bare hashing algorithm to secure keys/passwords). I've been going with passlib's pbkdf2_sha512 scheme to great satisfaction in another (non-OpenStack) project, and recommend it highly. Something like:

    passlib.context.CryptContext(all__vary_rounds=0.1, default="pbkdf2_sha512",
        pbkdf2_sha512__default_rounds=1000, schemes=["pbkdf2_sha512"])

[Steve Martinelli (stevemar)]

Marking bug 1176134 as a dupe of this bug, since this bug as more detail. I'll add the description here:

=====
1176134: Password handling should be pluggable

As of now in sql backend, password handling code is embedded in identity driver. (ie), number of iteration, how the hash value is calculated, salt value etc. Ideally it should be pluggable with the current code be the default implementation
=====

[Morgan Fainberg (mdrnstm)]

Moving this to "high" as sha512_crypt is totally insufficient for password hashes.

[Morgan Fainberg (mdrnstm)]

Totally insufficient in the way it is implemented as described by Jeremy use in a key derivation methcanism is just fine. However, keystone is using sha512_crypt instead of pbkdf2_sha512 or bcrypt or scrypt, etc.

[OpenStack Infra (hudson-openstack)]

Related fix proposed to branch: master
Review: https://review.openstack.org/438808

[OpenStack Infra (hudson-openstack)]

Change abandoned by Morgan Fainberg (<email address hidden>) on branch: master
Review: https://review.openstack.org/438808
Reason: Abandoning, no backports needed can go with a more comprehensive fix

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/438701
Committed: https://git.openstack.org/cgit/openstack/keystone/commit/?id=8ad765e0230ceeb5ca7c36ec3ed6d25c57b22c9d
Submitter: Jenkins
Branch: master

commit 8ad765e0230ceeb5ca7c36ec3ed6d25c57b22c9d
Author: Morgan Fainberg <email address hidden>
Date: Mon Feb 27 13:06:07 2017 -0800

    Support new hashing algorithms for securely storing password hashes

    Support bcrypt, pbkdf2_sha512, or scrypt in password hashing for
    passwords managed within keystone. sha512_crypt is insufficient to
    hash passwords in a secure way for storage in the DB. Keystone defaults
    now to using bcrypt but can handle scrypt and pbkdf2_sha512 with a number
    of tuning options if desired.

    Closes-bug: #1543048
    Closes-bug: #1668503
    Change-Id: Id05026720839d94de26d0e44631deb34bcc0e610

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/keystone 12.0.0.0b2 development milestone.