{"action":"created","issue":{"url":"https://api.github.com/repos/spring-projects/spring-security/issues/4232","repository_url":"https://api.github.com/repos/spring-projects/spring-security","labels_url":"https://api.github.com/repos/spring-projects/spring-security/issues/4232/labels{/name}","comments_url":"https://api.github.com/repos/spring-projects/spring-security/issues/4232/comments","events_url":"https://api.github.com/repos/spring-projects/spring-security/issues/4232/events","html_url":"https://github.com/spring-projects/spring-security/pull/4232","id":210878121,"number":4232,"title":"Fully customizable PBKDF2 password encoder","user":{"login":"gwallet","id":443041,"avatar_url":"https://avatars0.githubusercontent.com/u/443041?v=4","gravatar_id":"","url":"https://api.github.com/users/gwallet","html_url":"https://github.com/gwallet","followers_url":"https://api.github.com/users/gwallet/followers","following_url":"https://api.github.com/users/gwallet/following{/other_user}","gists_url":"https://api.github.com/users/gwallet/gists{/gist_id}","starred_url":"https://api.github.com/users/gwallet/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/gwallet/subscriptions","organizations_url":"https://api.github.com/users/gwallet/orgs","repos_url":"https://api.github.com/users/gwallet/repos","events_url":"https://api.github.com/users/gwallet/events{/privacy}","received_events_url":"https://api.github.com/users/gwallet/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":3,"created_at":"2017-02-28T19:10:59Z","updated_at":"2017-10-24T13:04:32Z","closed_at":"2017-10-24T13:04:32Z","author_association":"NONE","pull_request":{"url":"https://api.github.com/repos/spring-projects/spring-security/pulls/4232","html_url":"https://github.com/spring-projects/spring-security/pull/4232","diff_url":"https://github.com/spring-projects/spring-security/pull/4232.diff","patch_url":"https://github.com/spring-projects/spring-security/pull/4232.patch"},"body":"Hi,\r\n\r\nI had once to implement a new org.springframework.security.crypto.password.PasswordEncoder to fulfill the following security requirements:\r\n- Hash algorithm: PBKDF2\r\n- PRF: HMAC-SHA256\r\n- Hash length: 256 bits\r\n- Salt length: 64 bits\r\n- Iteration count: 100,000\r\n\r\nKeeping an eye on the project to migrate on an existing one, I find out the new one org.springframework.security.crypto.password.Pbkdf2PasswordEncoder was close to fit but suffer from a lack of customization regarding to the above requirements.\r\n\r\nHere comes a suggestion to enable the use of PBKDF2 as password encoder algorithm (like mentioned in #2383) with some settings improvement.\r\nThe new PBKDF2 password encoder :\r\n- makes PBKDF2 algorithm a first class citizen (like BCrypt)\r\n- uses one of the PBKDF2 flavor supported by the platform (like HMAC-SHA256 and HMAC-SHA512 [starting from JDK 8](http://docs.oracle.com/javase/8/docs/technotes/guides/security/StandardNames.html#SecretKeyFactory))\r\n- uses the given salt/hash length, iterations count\r\n- uses the given codec in order to represent the hash as Base64 or Hexadecimal, ... or whatever\r\n\r\nBecause it's not fully backward compatible with the previous one (no secret key), I choose to  deprecate it in and create a new dedicated package.\r\n\r\nI tried to follow coding guideline, to test it and to document as much as possible, any review's feedback will be welcome.\r\n"},"comment":{"url":"https://api.github.com/repos/spring-projects/spring-security/issues/comments/338982769","html_url":"https://github.com/spring-projects/spring-security/pull/4232#issuecomment-338982769","issue_url":"https://api.github.com/repos/spring-projects/spring-security/issues/4232","id":338982769,"user":{"login":"rwinch","id":362503,"avatar_url":"https://avatars0.githubusercontent.com/u/362503?v=4","gravatar_id":"","url":"https://api.github.com/users/rwinch","html_url":"https://github.com/rwinch","followers_url":"https://api.github.com/users/rwinch/followers","following_url":"https://api.github.com/users/rwinch/following{/other_user}","gists_url":"https://api.github.com/users/rwinch/gists{/gist_id}","starred_url":"https://api.github.com/users/rwinch/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rwinch/subscriptions","organizations_url":"https://api.github.com/users/rwinch/orgs","repos_url":"https://api.github.com/users/rwinch/repos","events_url":"https://api.github.com/users/rwinch/events{/privacy}","received_events_url":"https://api.github.com/users/rwinch/received_events","type":"User","site_admin":false},"created_at":"2017-10-24T13:04:32Z","updated_at":"2017-10-24T13:04:32Z","author_association":"MEMBER","body":"Thanks for the PR @gwallet! While we want to support customization PBKDF2, we don't want to deprecate our existing implementation if we do not need to (I don't think we do).  We also would like to avoid duplication since we already have utilities for [Base64 encoding](https://github.com/spring-projects/spring-security/blob/5.0.0.M5/crypto/src/main/java/org/springframework/security/crypto/codec/Base64.java) (which are deprecated since in JDK 8 provides encoding utilities already).\r\n\r\nUltimately, I agree with the the goal of this PR (ability to customize PBKDF2), but I would like to try to do this in a less invasive way."}}
{"actor":{"display_login":"rwinch"}}