[CASSANDRA-11022] Use SHA hashing to store password in the credentials cache

• Type: New Feature
• Status: Open
• Priority: Normal
• Resolution: Unresolved
• Fix Version/s: 5.x
• Component/s: Feature/Authorization
• Assignee: Unassigned Assign to me
• Reporter: Mike Adamson
• Created: 15/Jan/16 16:03
• Updated: 07/Mar/23 10:53

Description

In CASSANDRA-7715 a credentials cache has been added to the PasswordAuthenticator to improve performance when multiple authentications occur for the same user.

Unfortunately, the bcrypt hash is being cached which is one of the major performance overheads in password authentication.

I propose that the cache is changed to use a SHA-<xxx> hash to store the user password. As long as the cache is cleared for the user on an unsuccessful authentication this won't significantly increase the ability of an attacker to use a brute force attack because every other attempt will use bcrypt.

Issue Links

• is related to: CASSANDRA-7715 Add a credentials cache to the PasswordAuthenticator