{"action":"created","issue":{"url":"https://api.github.com/repos/symphonycms/symphony-2/issues/2413","labels_url":"https://api.github.com/repos/symphonycms/symphony-2/issues/2413/labels{/name}","comments_url":"https://api.github.com/repos/symphonycms/symphony-2/issues/2413/comments","events_url":"https://api.github.com/repos/symphonycms/symphony-2/issues/2413/events","html_url":"https://github.com/symphonycms/symphony-2/issues/2413","id":71798930,"number":2413,"title":"Raise PBKDF2 iterations","user":{"login":"nils-werner","id":88704,"avatar_url":"https://avatars.githubusercontent.com/u/88704?v=3","gravatar_id":"","url":"https://api.github.com/users/nils-werner","html_url":"https://github.com/nils-werner","followers_url":"https://api.github.com/users/nils-werner/followers","following_url":"https://api.github.com/users/nils-werner/following{/other_user}","gists_url":"https://api.github.com/users/nils-werner/gists{/gist_id}","starred_url":"https://api.github.com/users/nils-werner/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nils-werner/subscriptions","organizations_url":"https://api.github.com/users/nils-werner/orgs","repos_url":"https://api.github.com/users/nils-werner/repos","events_url":"https://api.github.com/users/nils-werner/events{/privacy}","received_events_url":"https://api.github.com/users/nils-werner/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":5,"created_at":"2015-04-29T07:17:44Z","updated_at":"2015-04-29T10:24:23Z","closed_at":null,"body":"At the time `cryptography` was written (2,5 years ago) [10,000 iterations](https://github.com/symphonycms/symphony-2/blob/master/symphony/lib/toolkit/cryptography/class.pbkdf2.php#L28) was the recommended setting. [Nowadays people recommend settings up to 10x the size of that.](http://chargen.matasano.com/chargen/2015/3/26/enough-with-the-salts-updates-on-secure-password-schemes.html)\r\n\r\nAs a reminder what iterations does: It wastes time and computation power, basically. The most common hashes are optimised for speed, but a fast algorithm is also more quickly brute-forceable. PBKDF2 implements an iterations count to basically arbitrarily raise the computational cost and slow down the algorithm. So while hardware gets faster, you may to make the algorithm slower to keep the computation time constant.\r\n\r\nI recommend setting iterations to 90,000 and in two-three years time to 800,000."},"comment":{"url":"https://api.github.com/repos/symphonycms/symphony-2/issues/comments/97379728","html_url":"https://github.com/symphonycms/symphony-2/issues/2413#issuecomment-97379728","issue_url":"https://api.github.com/repos/symphonycms/symphony-2/issues/2413","id":97379728,"user":{"login":"michael-e","id":40072,"avatar_url":"https://avatars.githubusercontent.com/u/40072?v=3","gravatar_id":"","url":"https://api.github.com/users/michael-e","html_url":"https://github.com/michael-e","followers_url":"https://api.github.com/users/michael-e/followers","following_url":"https://api.github.com/users/michael-e/following{/other_user}","gists_url":"https://api.github.com/users/michael-e/gists{/gist_id}","starred_url":"https://api.github.com/users/michael-e/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/michael-e/subscriptions","organizations_url":"https://api.github.com/users/michael-e/orgs","repos_url":"https://api.github.com/users/michael-e/repos","events_url":"https://api.github.com/users/michael-e/events{/privacy}","received_events_url":"https://api.github.com/users/michael-e/received_events","type":"User","site_admin":false},"created_at":"2015-04-29T10:24:23Z","updated_at":"2015-04-29T10:24:23Z","body":"> Old passwords will still validate fine.\r\n\r\n> Migration will happen automatically: next login will validate against old hash and create a new one.\r\n\r\nI tested it, and it works for both (Symphony and Members) __only if you log out__ before the iterations value gets changed. However, if you are logged in, things will break (and I had to use the password reset mechanism in Symphony and Members).\r\n"}}