NF12 Improve Password Hashing
From iDempiere en
Revision as of 08:14, 4 November 2025 by Hengsin (talk | contribs) (Created page with "= '''Feature:''' Improve Password Hashing= '''Goal:''' Technical '''Developer:''' Carlos Ruiz Heng Sin '''Description:''' Currently pa...")
Feature: Improve Password Hashing
Goal: Technical
Developer: Carlos Ruiz Heng Sin
Description:
Currently password hashing is using SHA-512 and salt is generated using SHA1PRNG random generator and 64 bytes.
This ticket make the following changes to improve the security of password hashing in iDempiere:
- Generate salt using the DRBG algorithm and 256 bit strength.
- Add support for PBKDF2 and Argon2 hashing algorithm.
Changes:
1. Added USER_PASSWORD_HASH_ALGORITHM System Configurator entry. Supported values are SHA-512, PBKDF2 and Argon2.
2. Added Password Hash Algorithm parameter to the Convert passwords to hashes process.
Migration of existing SHA-512 hashes:
- Change USER_PASSWORD_HASH_ALGORITHM System Configurator entry to PBKDF2 or Argon2, reset cache.
- User's password will be rehashed using the newly set algorithm when they login next time.
Technical Info: IDEMPIERE-6712
