[DERBY-5550] Document derby.authentication.builtin.saltLength and derby.authentication.builtin.iterations

• Type: Improvement
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 10.9.1.0
• Fix Version/s: 10.9.1.0
• Component/s: Documentation
• Assignee: Camilla Haase
• Reporter: Knut Anders Hatlen
• Created: 21/Dec/11 11:01
• Updated: 02/Apr/12 15:46
• Resolved: 27/Mar/12 17:24

Description

DERBY-5539 introduced two new properties that control how BUILTIN stores credentials:

• derby.authentication.builtin.saltLength (default: 16)

This property specifies the number of bytes of random salt that will be added to the credentials before hashing them. (Purpose of the property: Make it infeasible to construct rainbow tables.)

• derby.authentication.builtin.iterations (default: 1000, minimum: 1)

This property specifies the number of times to apply the hash function (which is specified by derby.authentication.builtin.algorithm) on the credentials. (Purpose of the property: Slow down attackers as they'll need to spend more time calculating hashes.)

Both the properties have effect only if BUILTIN authentication is enabled and derby.authentication.builtin.algorithm has a non-null value.

Issue Links

• is part of: DERBY-5539 Harden password hashing in the builtin authentication service