[OFBIZ-3006] entity encrypt columns not using encryption salt value?

• Type: Sub-task
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: Trunk
• Fix Version/s: Trunk
• Component/s: framework
• Sprint: Bug Crush Event - 21/2/2015
• Assignee: Adam Heath
• Reporter: chris snow
• Created: 07/Oct/09 07:35
• Updated: 24/Jun/14 06:55
• Resolved: 24/Jun/14 01:36

Description

It looks as though no salt data is used when saving encrypted entity data making the stored data susceptible to dictionary attacks.

If you look through the stored demo data, you can see all the demo accounts passwords are the same:

UserLogin:
admin     {SHA}47ca69ebb4bdc9ae0adec130880165d2cc05db1a
flexadmin {SHA}47ca69ebb4bdc9ae0adec130880165d2cc05db1a
...

As a comparison, if you create a two unix accounts, "ofbiz1" and "ofbiz2" and set both passwords to "ofbiz"

ofbiz1:$6$3.mYZg9u$0E...:14524:0:99999:7:::
ofbiz2:$6$MJhYeMqO$Jf...:14524:0:99999:7:::

You can see that on unix, even though the passwords are the same, the encrypted values are completely different.

For more information see:

http://en.wikipedia.org/wiki/Salt_(cryptography)

Issue Links

• blocks: OFBIZ-1151 Passwords are not salted