CE 1.8 inherits from EE 1.13 and lists as a change:
“The cryptographic methods used to store passwords were improved to enhance security”

As far as I know, earlier versions used APR1 which is a 1000 iteration loop of MD5 with a 32-bit salt, then encodes the 128-bit result in 6-bit chunks to a text readable format using a fixed 64 entry array of printable characters.

How has this changed in the new versions? There does not seem to be any documentation with any details.


Community Edition

In the old version (CE magento hashed passwords with md5 and a 2 char salt. No iterations, just one hashing.

With 1.8 the method changed ... a little bit. They changed the salt lentgh from 2 to 32. The method is still bad.

Enterprise Edition

The enterprise edition does nearly the same. The difference is (before 1.13!) they use sha256(). I don't know what they use in 1.13

Advertisement for PBKDF2

If you want to hash the user passwords in a better way, you can install my module: https://github.com/ikonoshirt/pbkdf2

It uses PBKDF2 for hashing password.

  • I totally did not believe you, and then spent a few hours digging through the code.... unfortunately you are correct. I understand why they did not want to give any details :/ Does EE use the same method? – Richie Frame Oct 27 '13 at 12:26
  • I should also note that the method they use to generate the salt returns a char of a-z,A-Z,0-9 which only has 62 unique values, so a 2 byte salt only had 1612 unique vals, the new method is equivalent to 190-bits of salt entropy (very good compared to v1.7 which was 10-bits). – Richie Frame Oct 27 '13 at 12:34
  • added EE and a little ad – Fabian Blechschmidt Oct 28 '13 at 11:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.