Lightweight Directory Access Protocol (LDAP): Hashed Attribute values for 'userPassword'

This document does not define a new standard. Its purpose is solely to correctly document what is widely implemented in LDAP servers and clients to avoid interop issues in case implementors have to support old legacy systems using this scheme. Strictly speaking the 'userPassword' attribute type, intended to be used to support the LDAP "simple" bind operation, was meant to only store clear text passwords . Although defined a more versatile password attribute 'authPassword' for storing hashed passwords this was not widely implemented in server and client implementations. Instead current LDAP deployments still rely on the password hashing scheme for attribute 'userPassword' introduced in especially since this attribute type is directly used in various object classes. The specification in is missing some formal aspects potentially leading to interop issues. Furthermore new hash algorithms are used today by various implementors which were not mentioned in . Therefore this document also updates by fully specifying how to store hashed password values in attribute 'userPassword' optionally using the SHA-2 hash algorithms . For this it focuses on documenting already implemented server and client implementations. The password hashing scheme {crypt} was left out from the syntax definition because there are many platform-specific variants of possible values. The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in . This document is being discussed on the ldapext@ietf.org mailing list.

userPassword values MUST be represented by following syntax:

hashandsalt = password-hash salt password-hash = cleartext-password = %x00-FF salt = %x00-FF ]]> Field salt SHALL be treated as a randomely chosen sequence of bytes. The length of the salt SHOULD be at least 64 bits but other salt length MAY be recommended for specific hash algorithms. Implementations MUST be prepared of handling field salt of arbitrary length. salt MUST be empty for non-salted hashing schemes. The field hashandsalt is generated by concatening the field password-hash and the salt. The field password-hash is generated by calculating the digest over the concatenation of password followed by salt. b64-hashandsalt is generated by encoding hashandsalt according to the base64 algorithm as specified in . The field scheme MUST be treated case-insensitive by all server and client implementations. Applications SHALL handle prefix "x-" in scheme just like any other scheme value without this prefix . Other specifications MAY update this document by defining other values for scheme. prefix Description Algorithm reference {MD5}MD-5 without salt {SMD5}salted MD-5 {SHA}SHA-1 without salt {SSHA}salted SHA-1 {SHA256}SHA-256 without salt {SSHA256}salted SHA-256 {SHA384}SHA-384 without salt {SSHA384}salted SHA-384 {SHA512}SHA-512 without salt {SSHA512}salted SHA-512

All implementations SHOULD prepare textual strings used as field password like described for clear-text storage in section 2.41 in before deriving a hash value from them. It is up to the implementation to determine what a textual password is. Hashed 'userPassword' values are only suitable for directly comparing it to a clear-text password. They SHOULD NOT be used in challenge-response authentication schemes. It is clear from the syntax specification that distinguishing clear-text passwords and hashed passwords is somewhat ambigous which is a well-known deficiency of this approach. Therefore implementing is RECOMMENDED if a better solution is strictly required. Implementations SHALL first check whether a value stored in attribute 'userPassword' adheres to the syntax specified above. Syntax checking SHALL be implemented by checking hash and optional salt following the algorithm-specific rules. Any value which do not adhere to this syntax MAY be treated as clear-text password by the DSA when processing a LDAP simple bind request or LDAP compare request. Servers MAY provide local configuration items to limit the set of hash schemes to be processed and for completely disabling use of clear-text passwords in attribute 'userPassword'.

The syntax definition for 'userPassword' values in this document is based on and supersedes the specification in section 5.3 of by L. Howard. Some basics of the formal specification and security considerations are based on text in by K. Zeilenga.

There are no identifiers defined herein to be reserved by IANA.

This document describes how authentication information may be stored in a directory. Authentication information MUST be adequately protected as unintended disclosure will allow attackers to gain immediate access to the directory as described by . Hashed values in attribute 'userPassword' SHOULD be protected as if they were clear text passwords because they are subject to dictionary or other attacks and flaws may be discovered in the hashing algorithm or with a particular implementation of the algorithm. Especially it is RECOMMENDED to avoid using hashing schemes based on MD-5 because of known weaknesses of this digest algorithm . Applications SHOULD NOT use the non-salted password hash schemes and SHOULD use a sufficiently long salt value. When values are transferred, privacy protections, such as IPSEC or TLS, SHOULD be in place. Clients SHOULD use stronger authentication mechanisms like defined in . Servers SHOULD use stronger credential storage mechanisms like defined in . Some password schemes may require CPU intensive operations. Servers SHOULD take appropriate measures to protect against Denial of Service attacks. Using 'userPassword' attribute type description as defined in does not restrict an authentication identity to a single password. An attacker who gains write access to this attribute may store additional values without disabling the user's true password(s). If a server supports defining additional local constraints to limit the count of attribute values it is RECOMMENDED to define such a constraint for 'userPassword' values to be limited to one without having to change the standard schema. Use of policy aware clients and servers is RECOMMENDED (see example in ). The level of protection offered against various attacks differ from scheme to scheme. It is RECOMMENDED that servers support scheme selection as a configuration item. This allows for a scheme to be easily disabled if a significant security flaw is discovered.