Skip to content

Frequently Asked Questions

Jump to bottom
Santiago Torres edited this page Jan 24, 2015 · 5 revisions

FAQ

This page contains questions specific for the django implementation of PolyPasswordHasher. To answer more general questions about the protection scheme and it's features you can visit the general FAQ

### What is a good value for partial bytes? Can I set it to zero?

The default value for partial bytes is 4, and it is a good compromise between protection and collision avoidance. We recommend to have it around this values. Definitely ensure there are a significant number of bytes of the hash protected by the share (e.g. for a 32 byte hash, do not make it more than eight).

If you set the value to zero, partial verification will be disabled. This means that you won't be able to allow log-in and create accounts until sufficient threshold accounts have provided their passwords.

### What is a safe value for the threshold?

This depends entirely on your workflow. Depending on how many administrators or trusted users you have, this number will be bigger or smaller. A safe assumption is that you want your threshold to be a little bit less than the number of expected threshold accounts. Let's say that you have 5 trusted users, then a value of 3 may be a good choice. Remember that the higher this value is, the harder it is for attackers to crack your database; the default value for this is 3.

<a name="threshold_number />

How many threshold accounts can I create?

django_pph supports 253 threshold accounts and as many thresholdless accounts as you want. If you have a lot of users, the best approach to this is to have a few trusted users as threshold accounts (e.g. 10) and store the rest of the users as thresholdless accounts.

<a name="locked_creation />

Can I create accounts with a locked store?

Yes, when creating accounts with a locked store, their hashes will be stored as a plain digest (not polypasswordhasher). After a successful unlock event, the hasher will scan the newly added user entries and automatically update their hash value.

### What are the negative share values?

These indicate the hasher that they aren't protected by PolyPasswordHasher yet. This happens when you create an account with a locked store.

### What are the supported hash algorithms?

The currently supported hash algorithm is pbkdf2_sha256, since it is the default for django implementations. We will be adding support for other hash algorithms soon.

### If the account database is stolen and partial verification is used, partial verification can let in a malicious user. How does django_pph identify these incidents?

Most of them can be detected when an attacked has provided a password that passes partial verification but not proper verification. In this case, the logger will write an error entry to the file or send an email to the administrator notifying of this event, depending on your settings.

Clone this wiki locally