Password Hashing

Question

Please confirm which hashing functions used/available for hashing passwords in databases when using database instead of other LDAP integration.

This link is showing SHA1 - surely this is no longer the case? : https://developer.atlassian.com/server/confluence/password-hash-algorithm/

hari_5aexaj · Answer

Hi,

Like I mentioned before we are not using plain SHA1 for hashing passwords (for which collision attacks were identified). The SHA1 usage in PBKDF2 is actually a HMAC-SHA1 which is not vulnerable to the same collision attacks as SHA1 hashing algorithm.

nobody_0sxxul · Answer

So you understand you are using broken hash algorithms but do not have immediate plans to change?

hari_5aexaj · Answer

Hi,

We don't use just SHA1 for hashing passwords. The SHA1 mentioned there is the PRF function needed for PBKDF2. We are continuously looking to improve this, but currently do not have immediate plans to change.