Skip to content

Commit 069054b

Browse files
lllamnyplllamnyp
committed
docs(api): say why two password formats hash without a salt
CodeQL flags the SHA-1 and SHA-256 of a password as weak hashing of sensitive data. Both are the forms the engines store and check against and accept in no other form, and the design relies on the 32-character random password rather than on the digest for strength, so the alerts are dismissed with that reason and the code says it where the hashing happens. Assisted-by: LLM Signed-off-by: Timofei Larkin <[email protected]>
1 parent 108b51d commit 069054b

1 file changed

Lines changed: 7 additions & 0 deletions

File tree

‎pkg/credentials/format/format.go‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -95,6 +95,9 @@ func Encode(name, password string) (string, error) {
9595
case MySQLNative:
9696
return encodeMySQLNative(password), nil
9797
case SHA256:
98+
// Unsalted by the engine's choice: ClickHouse checks a login against
99+
// password_sha256_hex and accepts no other form. The 32-character
100+
// random password behind it is what makes the digest safe to store.
98101
sum := sha256.Sum256([]byte(password))
99102
return hex.EncodeToString(sum[:]), nil
100103
case Plaintext:
@@ -130,6 +133,10 @@ func hmacSHA256(key []byte, message string) []byte {
130133
return mac.Sum(nil)
131134
}
132135

136+
// encodeMySQLNative is MariaDB's PASSWORD(): SHA-1 of SHA-1, unsalted, which
137+
// the mysql_native_password plugin stores and checks against and accepts in no
138+
// other form. The 32-character random password behind it is what makes the
139+
// digest safe to store.
133140
func encodeMySQLNative(password string) string {
134141
first := sha1.Sum([]byte(password))
135142
second := sha1.Sum(first[:])

0 commit comments

Comments
 (0)