Олег Давидович: 1 версия импортирована

2024-10-18T06:43:16Z

1 версия импортирована

← Предыдущая версия	Версия от 06:43, 18 октября 2024
(нет различий)

1>Tsala: removing new features template

2024-03-26T10:00:02Z

removing new features template

Новая страница

{{Security}}
==Moodle LMS hashing algorithm==
From version 4.3 onwards, Moodle LMS uses [https://en.wikipedia.org/wiki/SHA-2 SHA2 - 512] (SHA-512) for hashing uses passwords. See: MDL-67390 <br/>
SHA-512 is a modern hashing algorithm that is approved by various government agencies and standards:

"The only approved hashing algorithm is Secure Hashing Algorithm 2 (SHA-2)." - https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/ism/cyber-security-guidelines/guidelines-cryptography

"NIST recommends that federal agencies transition away from SHA-1 for all applications as soon as possible. Federal agencies should use SHA-2 or SHA-3 as an alternative to SHA-1." - https://csrc.nist.gov/Projects/Hash-Functions/NIST-Policy-on-Hash-Functions

==Legacy hashing==
Up until Moodle 2.3 the MD5 hashing alogrithm was used to hash passwords. Between versions 2.3 and 4.2 Moodle used the BCRYPT hashing algorithm.

Between versions 2.3 and and 4.2 users who had a MD5 hashed password were upgraded to the BCRYPT algorithm on login. As of version 4.3 any remaining MD5 passwords in the Moodle instances database (meaning that the user had not logged in since the release of Moodle 2.3) are replaced with a random SHA512 string. Any users that this applies to will need to reset their password to be able to log in.

From Moodle 4.3, users with (the now) legacy password hashe encrypted with the BCRYPT algorithm, will have their hash upgraded to SHA512 when they next login.

[[de:Passwort-Hash]]

Password hashing - История изменений

Олег Давидович: 1 версия импортирована

1>Tsala: removing new features template