insecure practice in password storage
- Dominant language
- Go
- Stars
- 14.3k
- Forks
- 1.1k
- Avg merge
- 6d 9h
- Merged PRs (30d)
- 11
Description
**Is your feature request related to a problem? Please describe.**
I've noticed that the project uses an insecure practice in password storage and RSA key size selection. Specifically, the project employs MD5 for hashing passwords, which is a fast and reversible hashing algorithm susceptible to rainbow table attacks. This can be found in `pgconn.go` at line 446. Furthermore, the RSA key size is currently set at 2048 bits, whereas NIST recommends using 3072 bits or higher for enhanced security. This latter issue is located in `generate_certs.go` at line 67.
**Describe the solution you'd like**
I suggest updating the password hashing mechanism to utilize a more secure algorithm, such as Argon2id, scrypt, or bcrypt, which are designed to be resource-intensive and thus protect against offline brute-force attacks. Regarding the RSA key size, I propose increasing it to 3072 bits to align with NIST recommendations and improve cryptographic strength. https://www.keylength.com/en/3/
**Describe alternatives you've considered**
An alternative for password hashing could involve using PBKDF2 with a high iteration count, although this is less preferred compared to the previously mentioned algorithms due to its relative simplicity and susceptibility to hardware-accelerated attacks. For the RSA key size, there is no real alternative; upgrading to a larger key size is essential for maintaining adequate security levels.
Contributor guide
Research direction
Start by reviewing the password hashing code at pgconn.go line 446 and the RSA key-size setting at generate_certs.go line 67. Determine the compatibility and implementation requirements for replacing MD5 and increasing the key size to 3072 bits; done means both insecure practices are addressed without breaking the project.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go, postgresql
- Domain
- cryptography, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100