Documentation for generating salted password lacking
- Dominant language
- Erlang
- Stars
- 36
- Forks
- 30
- PR merge metrics
- No merged PRs in 30d
Description
The [documentation](https://docs.emqx.io/en/broker/v4.3/advanced/auth.html#how-to-generate-authentication-information) describes the process of how to generate a salted password. However, the description on point 2 really makes it very difficult to follow. It is described that "same salting rules and hash method as MySQL authentication" should be used. Presumably, [this](https://dev.mysql.com/doc/internals/en/secure-password-authentication.html#packet-Authentication::Native41) is the method referenced. This method however utilizes SHA1, whereas emqx_auth_pgsql also supports other cryptographic algorithms. In addition, there is no description about how the salt enters the equation (presumably in place of the randomized 20-bit sequence).
This really needs to be improved. I still cannot wrap my head around how to generate hashed passwords and salts in order to make the plugin able to authenticate.
IMHO, the plugin should use the methods available for cryptography in PostgreSQL, i.e. the [pgcrypto](https://www.postgresql.org/docs/9.2/pgcrypto.html#PGCRYPTO-ICFC-TABLE) `crypto` method, specifically designed for managing cryptography for passwords.
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.