jackc / jackc/pgx

insecure practice in password storage

Open
#2,044 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
14.3k
Forks
1.1k
Avg merge
6d 9h
Merged PRs (30d)
11

Description

**Is your feature request related to a problem? Please describe.**
I've noticed that the project uses an insecure practice in password storage and RSA key size selection. Specifically, the project employs MD5 for hashing passwords, which is a fast and reversible hashing algorithm susceptible to rainbow table attacks. This can be found in `pgconn.go` at line 446. Furthermore, the RSA key size is currently set at 2048 bits, whereas NIST recommends using 3072 bits or higher for enhanced security. This latter issue is located in `generate_certs.go` at line 67.

**Describe the solution you'd like**
I suggest updating the password hashing mechanism to utilize a more secure algorithm, such as Argon2id, scrypt, or bcrypt, which are designed to be resource-intensive and thus protect against offline brute-force attacks. Regarding the RSA key size, I propose increasing it to 3072 bits to align with NIST recommendations and improve cryptographic strength. https://www.keylength.com/en/3/

**Describe alternatives you've considered**
An alternative for password hashing could involve using PBKDF2 with a high iteration count, although this is less preferred compared to the previously mentioned algorithms due to its relative simplicity and susceptibility to hardware-accelerated attacks. For the RSA key size, there is no real alternative; upgrading to a larger key size is essential for maintaining adequate security levels.

Contributor guide

Open the contributing guide

Research direction

Start by reviewing the password hashing code at pgconn.go line 446 and the RSA key-size setting at generate_certs.go line 67. Determine the compatibility and implementation requirements for replacing MD5 and increasing the key size to 3072 bits; done means both insecure practices are addressed without breaking the project.

Written by the indexing model from the issue text.

Assessment

Tech stack
go, postgresql
Domain
cryptography, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.