Password storage options

Jan Blizničenko wrote

Hello

I'm working on Pharo-based webserver and right now I got to the topic of
storing user passwords. I found SHA256 integrated in Pharo, but hashing with
SHA is far from enough. I also looked around the mailing list history to
find few posts from 2011 about bcrypt using Linux libraries. I'd like to ask
what is current status - what are my options under following conditions:

I prefer Pharo 5 compatibility. I could downgrade to Pharo 4 or use beta
Pharo 6, but latest stable relase is preferred.

I require at least bcrypt or PDKBF2, but I much more prefer
GPU-attack-resistant solutions like scrypt or Argon2.

I require Linux compatibility, but platform independent solution would be
kinda nice (we could use the same algorithm on our local machines with Mac
and Win for development).

Thank you
Jan



--
View this message in context: http://forum.world.st/Password-storage-options-tp4927471.html
Sent from the Pharo Smalltalk Users mailing list archive at Nabble.com.

... [show rest of quote]

Paul DeBruicker wrote

I made a crypt/bcrypt ffi library for older versions of Pharo that sounds like it meets your needs and is  in the cryptography project here:

http://smalltalkhub.com/#!/~Cryptography/Cryptography

But I have not updated it for the new FFI versions in Pharo 5/6.



And Pierce Ng made a blog post and library about his own set up here:
http://www.samadhiweb.com/blog/2013.11.17.shacrypt.html

Jan Blizničenko wrote

Hello

I'm working on Pharo-based webserver and right now I got to the topic of
storing user passwords. I found SHA256 integrated in Pharo, but hashing with
SHA is far from enough. I also looked around the mailing list history to
find few posts from 2011 about bcrypt using Linux libraries. I'd like to ask
what is current status - what are my options under following conditions:

I prefer Pharo 5 compatibility. I could downgrade to Pharo 4 or use beta
Pharo 6, but latest stable relase is preferred.

I require at least bcrypt or PDKBF2, but I much more prefer
GPU-attack-resistant solutions like scrypt or Argon2.

I require Linux compatibility, but platform independent solution would be
kinda nice (we could use the same algorithm on our local machines with Mac
and Win for development).

Thank you
Jan



--
View this message in context: http://forum.world.st/Password-storage-options-tp4927471.html
Sent from the Pharo Smalltalk Users mailing list archive at Nabble.com.

... [show rest of quote]

... [show rest of quote]

... [show rest of quote]

Paul DeBruicker wrote

And to add scrypt to that FFI library would be trivial if you have a 32bit version of scrypt but I don't think there is one.  I'd be happy to learn I'm wrong though.  And thats assuming you're using 32 bit pharo, which is whats stable/released right now.

Paul DeBruicker wrote

I made a crypt/bcrypt ffi library for older versions of Pharo that sounds like it meets your needs and is  in the cryptography project here:

http://smalltalkhub.com/#!/~Cryptography/Cryptography

But I have not updated it for the new FFI versions in Pharo 5/6.



And Pierce Ng made a blog post and library about his own set up here:
http://www.samadhiweb.com/blog/2013.11.17.shacrypt.html

Jan Blizničenko wrote

Hello

I'm working on Pharo-based webserver and right now I got to the topic of
storing user passwords. I found SHA256 integrated in Pharo, but hashing with
SHA is far from enough. I also looked around the mailing list history to
find few posts from 2011 about bcrypt using Linux libraries. I'd like to ask
what is current status - what are my options under following conditions:

I prefer Pharo 5 compatibility. I could downgrade to Pharo 4 or use beta
Pharo 6, but latest stable relase is preferred.

I require at least bcrypt or PDKBF2, but I much more prefer
GPU-attack-resistant solutions like scrypt or Argon2.

I require Linux compatibility, but platform independent solution would be
kinda nice (we could use the same algorithm on our local machines with Mac
and Win for development).

Thank you
Jan



--
View this message in context: http://forum.world.st/Password-storage-options-tp4927471.html
Sent from the Pharo Smalltalk Users mailing list archive at Nabble.com.

... [show rest of quote]

... [show rest of quote]

... [show rest of quote]

... [show rest of quote]

... [show rest of quote]

Jan Blizničenko wrote

Thank you a lot! :)

I tried it in Pharo 5 and everything seems to be working (I just had to apt-get install libxcrypt:i386, load packages Cryptography, Blowfish (not sure if really needed though) and PasswordHashingFFI and manually create link in directory where it expected libxcrypt.so.1). About the FFI for Pharo 5/6, maybe that's what Esteban Maringolo did in commit "Cryptography-EstebanMaringolo.50" on 15 September 2016 "Version ready to be loaded in Pharo 5.0 without affecting Kernel or System packages.".

Scrypt would be even better to have, but I'm grateful enough for now since it was all easier and faster than I expected.

Jan

Paul DeBruicker wrote

And to add scrypt to that FFI library would be trivial if you have a 32bit version of scrypt but I don't think there is one.  I'd be happy to learn I'm wrong though.  And thats assuming you're using 32 bit pharo, which is whats stable/released right now.

Paul DeBruicker wrote

I made a crypt/bcrypt ffi library for older versions of Pharo that sounds like it meets your needs and is  in the cryptography project here:

http://smalltalkhub.com/#!/~Cryptography/Cryptography

But I have not updated it for the new FFI versions in Pharo 5/6.



And Pierce Ng made a blog post and library about his own set up here:
http://www.samadhiweb.com/blog/2013.11.17.shacrypt.html

Jan Blizničenko wrote

Hello

I'm working on Pharo-based webserver and right now I got to the topic of
storing user passwords. I found SHA256 integrated in Pharo, but hashing with
SHA is far from enough. I also looked around the mailing list history to
find few posts from 2011 about bcrypt using Linux libraries. I'd like to ask
what is current status - what are my options under following conditions:

I prefer Pharo 5 compatibility. I could downgrade to Pharo 4 or use beta
Pharo 6, but latest stable relase is preferred.

I require at least bcrypt or PDKBF2, but I much more prefer
GPU-attack-resistant solutions like scrypt or Argon2.

I require Linux compatibility, but platform independent solution would be
kinda nice (we could use the same algorithm on our local machines with Mac
and Win for development).

Thank you
Jan



--
View this message in context: http://forum.world.st/Password-storage-options-tp4927471.html
Sent from the Pharo Smalltalk Users mailing list archive at Nabble.com.

... [show rest of quote]

... [show rest of quote]

... [show rest of quote]

... [show rest of quote]

... [show rest of quote]

... [show rest of quote]

... [show rest of quote]

Jan Blizničenko wrote

Ah, it seems I just did not switched it on - it does not work after all.

I tried it with PasswordHashingFFI-PaulDeBrulcker.16.mcz, but also with 15 and 8.

On Pharo 5, it calls many methods which I do not have in my environment, for example in BCryptLinuxFFI>>#generateBCryptSalt: there is line with "self randomBCryptSalt: saltSize", but there is no implementor of "randomBCryptSalt:". Also, in many methods of BCryptLinuxFFI there are message sends "greaseString" to variables cointaining probably integers, but there is also no implementor of greaseString.

So I tried it on Pharo 4 - it does not even load, because it needs class ExternalStructure. So I found I need to download the FFI, I tried to do so using code below, but loading failed with MessageNotUnderstood: receiver of "selector" is nil.

Gofer new
  squeaksource: 'MetacelloRepository';
  package: 'ConfigurationOfFFI';
  load.
(Smalltalk at: #ConfigurationOfFFI) project lastVersion load

So, I'm not sure what to try next to make it work.

Jan

Jan Blizničenko wrote

Thank you a lot! :)

I tried it in Pharo 5 and everything seems to be working (I just had to apt-get install libxcrypt:i386, load packages Cryptography, Blowfish (not sure if really needed though) and PasswordHashingFFI and manually create link in directory where it expected libxcrypt.so.1). About the FFI for Pharo 5/6, maybe that's what Esteban Maringolo did in commit "Cryptography-EstebanMaringolo.50" on 15 September 2016 "Version ready to be loaded in Pharo 5.0 without affecting Kernel or System packages.".

Scrypt would be even better to have, but I'm grateful enough for now since it was all easier and faster than I expected.

Jan

Paul DeBruicker wrote

And to add scrypt to that FFI library would be trivial if you have a 32bit version of scrypt but I don't think there is one.  I'd be happy to learn I'm wrong though.  And thats assuming you're using 32 bit pharo, which is whats stable/released right now.

Paul DeBruicker wrote

I made a crypt/bcrypt ffi library for older versions of Pharo that sounds like it meets your needs and is  in the cryptography project here:

http://smalltalkhub.com/#!/~Cryptography/Cryptography

But I have not updated it for the new FFI versions in Pharo 5/6.



And Pierce Ng made a blog post and library about his own set up here:
http://www.samadhiweb.com/blog/2013.11.17.shacrypt.html

Jan Blizničenko wrote

Hello

I'm working on Pharo-based webserver and right now I got to the topic of
storing user passwords. I found SHA256 integrated in Pharo, but hashing with
SHA is far from enough. I also looked around the mailing list history to
find few posts from 2011 about bcrypt using Linux libraries. I'd like to ask
what is current status - what are my options under following conditions:

I prefer Pharo 5 compatibility. I could downgrade to Pharo 4 or use beta
Pharo 6, but latest stable relase is preferred.

I require at least bcrypt or PDKBF2, but I much more prefer
GPU-attack-resistant solutions like scrypt or Argon2.

I require Linux compatibility, but platform independent solution would be
kinda nice (we could use the same algorithm on our local machines with Mac
and Win for development).

Thank you
Jan



--
View this message in context: http://forum.world.st/Password-storage-options-tp4927471.html
Sent from the Pharo Smalltalk Users mailing list archive at Nabble.com.

... [show rest of quote]

... [show rest of quote]

... [show rest of quote]

... [show rest of quote]

... [show rest of quote]

... [show rest of quote]

... [show rest of quote]

... [show rest of quote]

... [show rest of quote]

Udo Schneider wrote

Hi Jan,

I extracted a PBKDF2 implementation from some of my code some time ago.
Take a look here:

http://readthesourceluke.blogspot.de/2014/07/pbkdf2-for-pharo.html
http://www.smalltalkhub.com/#!/~UdoSchneider/PBKDF2

CU,

Udo

On 19/12/16 18:09, Jan Blizničenko wrote:
> Hello
>
> I'm working on Pharo-based webserver and right now I got to the topic of
> storing user passwords. I found SHA256 integrated in Pharo, but hashing with
> SHA is far from enough. I also looked around the mailing list history to
> find few posts from 2011 about bcrypt using Linux libraries. I'd like to ask
> what is current status - what are my options under following conditions:
>
> I prefer Pharo 5 compatibility. I could downgrade to Pharo 4 or use beta
> Pharo 6, but latest stable relase is preferred.
>
> I require at least bcrypt or PDKBF2, but I much more prefer
> GPU-attack-resistant solutions like scrypt or Argon2.
>
> I require Linux compatibility, but platform independent solution would be
> kinda nice (we could use the same algorithm on our local machines with Mac
> and Win for development).
>
> Thank you
> Jan
>
>
>
> --
> View this message in context: http://forum.world.st/Password-storage-options-tp4927471.html
> Sent from the Pharo Smalltalk Users mailing list archive at Nabble.com.
>
>

... [show rest of quote]