Determines how the hashing is computed in the implementation
You can implement this to provide a different hashing strategy to the default.
| package |
Default |
|---|
__construct()
computeHash( $arg0, $arg1, $arg2) : string
string
string
integer
stringthe hashed password
createPBKDF2( $arg0) : \io\vertx\jphp\ext\auth\jdbc\JDBCHashStrategy
New deployments should use this strategy instead of the default one (which was the previous OWASP recommendation).
The work factor can be updated by using the nonces json array.
Vertx
\io\vertx\jphp\ext\auth\jdbc\JDBCHashStrategythe implementation.
createSHA512( $arg0) : \io\vertx\jphp\ext\auth\jdbc\JDBCHashStrategy
generateSalt() : string
stringa non null salt value
getHashedStoredPwd( $arg0) : string
array
stringthe hashed password
getSalt( $arg0) : string
array
stringthe salt
isEqual( $arg0, $arg1) : boolean
string
string
booleantrue if equal
setNonces( $arg0) : void
The nonces are supposed not to be stored in the underlying jdbc storage but to be provided as a application configuration. The idea is to add one extra variable to the hash function in order to make breaking the passwords using rainbow tables or precomputed hashes harder. Leaving the attacker only with the brute force approach.
Nonces are dependent on the implementation. E.g.: for the SHA512 they are extra salt used during the hashing, for the PBKDF2 they map the number of iterations the algorithm should take
array