shiro-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Alan D. Cabrera" <>
Subject Password and hash management
Date Sun, 24 Oct 2010 05:25:52 GMT
An earlier discussion about hashing and inheritance kicked up an issue that I thought Shiro
might want to address.  The discussions about salted hashing are a good segue.

Sometimes my secure hashes are long lived.  I usually will hash something but prefix the string
to be hashed with a secret password; I will usually add a bit of salt too.  Often I will need
to change the password to that hash on a periodic basis. Sometimes I find out that a particular
hash algorithm is no longer secure and need to change my hash.  What do I do with the old
hashes?  How can I tell them apart from the new ones?

What I do is store the hashes as tuples which contain enough information my code to figure
out what hash to use.  All of this applies to encryption as well.

I'm wondering is if we should provide some kind of manager to manage all this. 

View raw message