[DERBY-5622] Reduce the chance for hash collisions when checking bootPassword at boot time and when changing password.

• Type: Improvement
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 10.8.3.0, 10.9.2.2, 10.10.1.1
• Component/s: Store
• Bug behavior facts: Data corruption, Security
• Assignee: Unassigned
• Reporter: Dag H. Wanvik
• Created: 17/Feb/12 21:03
• Updated: 03/Sep/14 08:31
• Resolved: 19/Jul/12 18:56

Description

There are two issues, already seen in DERBY-2687:

"the boot issue": there is a 1/2**16 chance that a wrong bootPassword will allow boot to proceed (but since its decoded key is wrong the boot will fail).
"the password change" issue: similarly, there is a chance that the wrong bootPassword will be accepted trying to change it via
SYSCS_UTIL.SYSCS_SET_DATABASE_PROPERTY('bootPassword', ...) at least for algorithms that do not check IV (initialization vector) in addition to the
digest, e.g. "DES/ECB/NoPadding"

The latter case may lead to data corruption, cf. DERBY-2687 discussion. I think the risk is fairly low, though: One would need to have execution permission to change the property if SQL authorization is used, and in most scenarios the supplied existing password would be correct. But since the results can be bad, it would be good to reduce or eliminate the risk.

Issue Links

• is related to: DERBY-2687 store/encryptDatabase.sql fails intermittently with ClassNotFoundException, Log Corrupted
• is related to: DERBY-5805 Database encryption topics in Reference Manual need more information