[SHIRO-213] Password and hash management

• Type: New Feature
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 1.2.0
• Assignee: Les Hazlewood
• Reporter: Alan Cabrera
• Created: 31/Oct/10 18:59
• Updated: 24/Jan/12 01:11
• Resolved: 13/Dec/11 01:38

Description

Sometimes secure hashes are long lived. I usually will hash something but prefix the string to be hashed with a secret password; I will usually add a bit of salt too. Often I will need to change the password to that hash on a periodic basis. Sometimes I find out that a particular hash algorithm is no longer secure and need to change my hash. What do I do with the old hashes? How can I tell them apart from the new ones?

What I do is store the hashes as tuples which contain enough information my code to figure out what hash to use. All of this applies to encryption as well.

I'm wondering is if we should provide some kind of manager to manage all this.

Issue Links

• relates to: SHIRO-280 Create a PasswordService to automate user password management techniques