osROSE Forums

Since it seems that osirose II uses new ways to protect passwords i tried to code a new registration page but when i try to actually connect it tells me the pass is incorrect.

The code works, it will insert data to the account table and it will encrypt the pass.
My guess is that this is not the good way to store Md5 and sha256.

If you have any ideas help would be appreciated

Connect.php


Register.php

Here is the auth code from osIROSE II (https://github.com/dev-osrose/osIROSE-n ... t.cpp#L107).

After a quick glance the passwords appear to be hashed using SHA256 with a random database per-user generated salt: https://github.com/dev-osrose/osIROSE-n ... e.sql#L396.

Here is what you would do for registration:
- Take user password
- Hash the password using SHA256 and salt from database. Looks like you can use this stored proc to do it in sql directly

Salt seems to be randomly generated per user for you so would do something like this:



Not tested but Raven/L3nn0x can verify.

That sounds about right.

You can use the stored SQL procedure directly if you prefer: "call create_account(username, password);" that will do it for you.

Don't hesitate if you have more questions

Ok so there was a BIG misconception on my part it seems.
Being used to the old osrose version i assumed that the second column was a password crypted in md5 and the third one a password crypted by sha256.

I'm not used to salt, still have to wrap my head around it.

Salting the hash is just an extra layer of security although I've never seen the salt generated per-user and stored in the database as well. Historically I've only ever seen is stored at the application level. You should definitely use that stored procedure L3nn0x mentioned, I missed it when I was looking at the code.

Salting per user means that you can't run a rainbow attack on the database.

If we salted on the application level it wouldn't help since the code is open source and people will always use the default salt

Oh I thought salting passwords on the database was to protect user information so if someone ever gets access to your database the attacker wont be able to straight up grab everyone's passwords

Not really.

To protect against what you describe, simy hashing the password is fine as it's a one way function that cannot be reverted. We add an additional layer of security with the salt.

Ok after reading a bit about salt i now understand why it exist and what it does.
Still i do have some issues with osirose, i must be mistaken on something.

Here is what i do :



I also tried the Lazy way of inputing values ( which works too )



Scrip works, it does input the values in the database.
As far as i understand we have to :
-Get the password
-Hash it with sha256
-Generate a salt
-Register the password as "hashed256 + salt" and register the salt in the salt column

Which is i believe what i'm doing yet i get the "incorrect password" each time i try to connect to rose.
What am i doing wrong ?

Does it work when you use the stored procedure ?



I don't know PHP so YMMV...