Password Encryption

[fer...@gmail.com]

Hi!

I am trying to understand how the encrypted password works. I have seen that the password is stored on the database field "pseudonyms.crypted_password". Doing some research on the code I found out that the encryption is on SHA512 so crypted_password should be like:

crypted_password = SHA512("plain_password"+password_salt)

But when I test it myself encrypting with SHA512 my password and the salt of that user (that I get from the same pseudonym table) I don't get the same encrypted password I see on the database.

So how is the password actually encrypted?

Thank you!

[Cody Cutrer]

The password is hashed 20 times: https://github.com/binarylogic/authlogic/blob/master/lib/authlogic/crypto_providers/sha512.rb

Also note that the salt comes _after_ the password: https://github.com/binarylogic/authlogic/blob/master/lib/authlogic/acts_as_authentic/password.rb#L301

Cody Cutrer

Software Engineer

Instructure

--

---
You received this message because you are subscribed to the Google Groups "Canvas LMS Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to canvas-lms-use...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[fer...@gmail.com]

Hi

I didn't understand what you mean with 

Also note that the salt comes _after_ the password: https://github.com/binarylogic/authlogic/blob/master/lib/authlogic/acts_as_authentic/password.rb#L301

In that code line I see that the array is raw_password and salt, so crypted password should be something like this:

 crypted_password = 20.times {SHA512("plain_password"+password_salt)}

No?

Thank you!

[Cody Cutrer]

I think you understand, but your pseudo-ruby-code is not quite correct:

```

crypted = "plain password" + salt

20.times { crypted = SHA512(crypted) }

```

Cody Cutrer

Software Engineer

Instructure

[fer...@gmail.com]

I got it now, thank you so much Cody!

[acplace...@gmail.com]

Can you please explain it more detail?  What does it mean 20 times?  

[ralph.otowo]

Sent from my Samsung Galaxy smartphone. P,

[Cody Cutrer]

It means that the password (plus salt) is hashed. Then that hash is hashed. Then _that_ hash is hashed. 20 times.

Cody Cutrer

Software Engineer

Instructure