Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Revisit the default cost for password hashing #55627

Open
jkakavas opened this issue Apr 22, 2020 · 2 comments
Open

Revisit the default cost for password hashing #55627

jkakavas opened this issue Apr 22, 2020 · 2 comments
Assignees
@gwbrown
Labels
:Security/Authentication Logging in, Usernames/passwords, Realms (Native/LDAP/AD/SAML/PKI/etc) Team:Security Meta label for security team v8.15.0

Comments

@jkakavas
Copy link
Member

The current defaults are

  • cost factor of 10 for bcrypt
  • 10000 iterations for PBKDF2

see #55544 (comment) also
@jkakavas jkakavas added :Security/Authentication Logging in, Usernames/passwords, Realms (Native/LDAP/AD/SAML/PKI/etc) v8.0.0 labels Apr 22, 2020
@elasticmachine
Copy link
Collaborator

Pinging @elastic/es-security (:Security/Authentication)

@rjernst rjernst added the Team:Security Meta label for security team label May 4, 2020
@arteam arteam added v8.1.0 and removed v8.0.0 labels Jan 12, 2022
@jkakavas jkakavas changed the title Revisit the default cost for password hashing for 8.0.0 Revisit the default cost for password hashing Jan 28, 2022
@mark-vieira mark-vieira added v8.2.0 and removed v8.1.0 labels Feb 2, 2022
@gwbrown gwbrown self-assigned this Mar 1, 2022
@mark-vieira mark-vieira added v8.5.0 and removed v8.4.0 labels Jul 27, 2022
@elasticsearchmachine
Copy link
Collaborator

Pinging @elastic/es-security (Team:Security)

@csoulios csoulios added v8.6.0 and removed v8.5.0 labels Sep 21, 2022
@kingherc kingherc added v8.7.0 and removed v8.6.0 labels Nov 16, 2022
@rjernst rjernst added v8.8.0 and removed v8.7.0 labels Feb 8, 2023
@gmarouli gmarouli added v8.9.0 and removed v8.8.0 labels Apr 26, 2023
@quux00 quux00 added v8.11.0 and removed v8.10.0 labels Aug 16, 2023
@mattc58 mattc58 removed the v8.11.0 label Oct 4, 2023
@mattc58 mattc58 added the v8.12.0 label Oct 4, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@gwbrown gwbrown

Labels
:Security/Authentication Logging in, Usernames/passwords, Realms (Native/LDAP/AD/SAML/PKI/etc) Team:Security Meta label for security team v8.15.0
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests