4

CE 1.8 inherits from EE 1.13 and lists as a change:
“The cryptographic methods used to store passwords were improved to enhance security”

As far as I know, earlier versions used APR1 which is a 1000 iteration loop of MD5 with a 32-bit salt, then encodes the 128-bit result in 6-bit chunks to a text readable format using a fixed 64 entry array of printable characters.

How has this changed in the new versions? There does not seem to be any documentation with any details.

1 Answer 1

3

Community Edition

In the old version (CE 1.7.0.2) magento hashed passwords with md5 and a 2 char salt. No iterations, just one hashing.

With 1.8 the method changed ... a little bit. They changed the salt lentgh from 2 to 32. The method is still bad.

Enterprise Edition

The enterprise edition does nearly the same. The difference is (before 1.13!) they use sha256(). I don't know what they use in 1.13

Advertisement for PBKDF2

If you want to hash the user passwords in a better way, you can install my module: https://github.com/ikonoshirt/pbkdf2

It uses PBKDF2 for hashing password.

3
  • I totally did not believe you, and then spent a few hours digging through the code.... unfortunately you are correct. I understand why they did not want to give any details :/ Does EE use the same method? Oct 27, 2013 at 12:26
  • I should also note that the method they use to generate the salt returns a char of a-z,A-Z,0-9 which only has 62 unique values, so a 2 byte salt only had 1612 unique vals, the new method is equivalent to 190-bits of salt entropy (very good compared to v1.7 which was 10-bits). Oct 27, 2013 at 12:34
  • added EE and a little ad Oct 28, 2013 at 11:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.