diff options
Diffstat (limited to 'doc/security/password_storage.md')
| -rw-r--r-- | doc/security/password_storage.md | 25 |
1 files changed, 8 insertions, 17 deletions
diff --git a/doc/security/password_storage.md b/doc/security/password_storage.md index 6b20f8619ae..bd514de6e2c 100644 --- a/doc/security/password_storage.md +++ b/doc/security/password_storage.md @@ -11,7 +11,8 @@ GitLab administrators can configure how passwords and OAuth tokens are stored. ## Password storage -> PBKDF2 and SHA512 [introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/360658) in GitLab 15.2 [with flags](../administration/feature_flags.md) named `pbkdf2_password_encryption` and `pbkdf2_password_encryption_write`. Disabled by default. +> - PBKDF2+SHA512 [introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/360658) in GitLab 15.2 [with flags](../administration/feature_flags.md) named `pbkdf2_password_encryption` and `pbkdf2_password_encryption_write`. Disabled by default. +> - Feature flags [removed](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/101691) in GitLab 15.6 and PBKDF2+SHA512 was made available to all GitLab instances running in [FIPS mode](../development/fips_compliance.md). GitLab stores user passwords in a hashed format to prevent passwords from being stored as plain text. @@ -23,17 +24,9 @@ library to hash user passwords. Created password hashes have these attributes: - **BCrypt**: By default, the [`bcrypt`](https://en.wikipedia.org/wiki/Bcrypt) hashing function is used to generate the hash of the provided password. This cryptographic hashing function is strong and industry-standard. - - **PBKDF2 and SHA512**: Starting in GitLab 15.2, PBKDF2 and SHA512 are supported - behind the following feature flags (disabled by default): - - `pbkdf2_password_encryption` - Enables reading and comparison of PBKDF2 + SHA512 - hashed passwords and supports fallback for BCrypt hashed passwords. - - `pbkdf2_password_encryption_write` - Enables new passwords to be saved - using PBKDF2 and SHA512, and existing BCrypt passwords to be migrated when users sign in. - - FLAG: - On self-managed GitLab, by default this feature is not available. To make it available, - ask an administrator to [enable the feature flags](../administration/feature_flags.md) named `pbkdf2_password_encryption` and `pbkdf2_password_encryption_write`. - + - **PBKDF2+SHA512**: PBKDF2+SHA512 is supported: + - In GitLab 15.2 to GitLab 15.5 when `pbkdf2_password_encryption` and `pbkdf2_password_encryption_write` [feature flags](../administration/feature_flags.md) are enabled. + - In GitLab 15.6 and later when [FIPS mode](../development/fips_compliance.md) is enabled (feature flags are not required). - **Stretching**: Password hashes are [stretched](https://en.wikipedia.org/wiki/Key_stretching) to harden against brute-force attacks. By default, GitLab uses a stretching factor of 10 for BCrypt and 20,000 for PBKDF2 + SHA512. @@ -45,9 +38,7 @@ library to hash user passwords. Created password hashes have these attributes: ## OAuth access token storage > - PBKDF2+SHA512 [introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/364110) in GitLab 15.3 [with flag](../administration/feature_flags.md) named `hash_oauth_tokens`. -> - [Enabled by default](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/98242) in GitLab 15.5. - -Depending on your version of GitLab and configuration, OAuth access tokens are stored in the database in PBKDF2+SHA512 format. For version information, see -the relevant [OAuth provider documentation](../integration/oauth_provider.md#hashed-oauth-tokens). +> - [Enabled by default](https://gitlab.com/gitlab-org/gitlab/-/issues/367570) in GitLab 15.5. +> - [Feature flag removed](https://gitlab.com/gitlab-org/gitlab/-/issues/367570) in GitLab 15.6. -As with PBKDF2+SHA512 password storage, access token values are [stretched](https://en.wikipedia.org/wiki/Key_stretching) 20,000 times to harden against brute-force attacks. +OAuth access tokens are stored in the database in PBKDF2+SHA512 format. As with PBKDF2+SHA512 password storage, access token values are [stretched](https://en.wikipedia.org/wiki/Key_stretching) 20,000 times to harden against brute-force attacks. |