Password Hashing

[nobody]

Please confirm which hashing functions used/available for hashing passwords in databases when using database instead of other LDAP integration.

This link is showing SHA1 - surely this is no longer the case? : https://developer.atlassian.com/server/confluence/password-hash-algorithm/

[Daniel Eads]

Hi,

The document you've linked notes that Confluence prior to 3.5 (which was many years ago) used a derivative of SHA1-512.

Embedded Crowd (used in Confluence) currently hashes with PBKDF2 and a round length of 10,000. You can read more about the specific implementation here.

Cheers,
Daniel

[nobody]

Which is also using SHA1

Is there nothing there with something suitable such as SHA2?

[hari]

Hi,

We don't use just SHA1 for hashing passwords. The SHA1 mentioned there is the PRF function needed for PBKDF2. We are continuously looking to improve this, but currently do not have immediate plans to change.

[nobody]

So you understand you are using broken hash algorithms but do not have immediate plans to change?

[hari]

Hi, 

Like I mentioned before we are not using plain SHA1 for hashing passwords (for which collision attacks were identified). The SHA1 usage in PBKDF2 is actually a HMAC-SHA1 which is not vulnerable to the same collision attacks as SHA1 hashing algorithm.