What hashing algorithm and length Orchestrator use for the credentials non SSO?
User passwords for non-SSO authentication are hashed using PBKDF2 with HMAC-SHA256, 128-bit salt, 256-bit subkey, 10000 iterations.
In terms of security and encryption, HMAC stands for Hash-based Message Authentication Code. HMAC involves hashing a message with a secret key. As a result, it can be used to verify the integrity and authenticity of a message.
When storing sensitive information like passwords, it is common to use a process called "salting" and hash iterations to increase security.
- The "128-bit salt" is a random and unique value for each user that is added to the password before hashing it. This is used to prevent attacks from using precomputed tables of hashed passwords
- "256 bit subkey" represents the length of the derived cryptographic key
- "1000 iterations" refers to the number of times the hashing function is applied. The idea is that by doing the process multiple times, it slows down the generation of the hash and makes brute-force attacks more difficult.