Password storage

OpenEMR Development
1

cbezuidenhout wrote on Tuesday, March 06, 2012:

Good Day to All,

I have been going through the password storage mechnasism in OpenEMR and found that we are using SHA-1 on the password with no salt, is this not a bit of a security risk ?

should we not at least be using SHA1($username.$password)

or even better yet should we not use SHA-256 ?

I know this seems like a drastic move, but the mechanisms are already built to move form MD5 to SHA-1, so shouldn’t be a problem to move to SHA-256, we are dealing with VERY sensitive data and security should be a top priority.

  - Craig
    Tajemo Enterprises

2

bradymiller wrote on Tuesday, March 06, 2012:

Hi,

I’m open to whatever is considered the “standard of care” here. One new issue (since the MD5 to SHA-1 mechanism was placed) that Z&H may want to weigh in on is if this may effect their portal SOAP functions that were added to OpenEMR for version 4.1 (I don’t think it will, because as I recall I think the user password for the portal is stored somewhere else).

-brady

3

zhhealthcare wrote on Tuesday, March 06, 2012:

Yes .The password for patient portal is saved in some other table. This mechanism is going to affect only the log in of users.

Eldho
ZH Healthcare

4

cbezuidenhout wrote on Wednesday, March 07, 2012:

Should I start working on moving over to SHA256 then ?

FYI a javascript implementation of SHA256 : http://www.movable-type.co.uk/scripts/sha256.html

  - Craig
    Tajemo Enterprises

5

bradymiller wrote on Thursday, March 08, 2012:

Hi,
If it will improve security, then it sounds like a good plan. Can a Meaningful Use weigh in here to ensure this format is covered under the security guidelines?
thanks,
-brady

6

bradymiller wrote on Thursday, March 08, 2012:

To clarify above:
Can a Meaningful Use expert weigh in here to ensure this format is covered under the security guidelines?

7

tmccormi wrote on Thursday, March 08, 2012:

170.210© - A hashing algorithm with a security strength equal to or greater than SHA-1 (Secure Hash Algorithm (SHA-1) as specified by the National Institute of Standards and Technology (NIST) in FIPS PUB 180-3 (October, 2008) must be used to verify that electronic health information has not been altered.

That is the only reference to using SHA-1, the user authentication tests don’t appear to reference any specific model, expect to say to follow the general rules for complience with FIPS-140-2

-Tony

8

yehster wrote on Thursday, March 08, 2012:

From a security standpoint, SHA1 vs. SHA256 shouldn’t matter at this point, SHA1 is still pretty strong. 
The lack of salt in the hashes is the greater concern as someone with access to the database might be able to determine users’ clear text passwords through the use of rainbow tables or a similar type of attack.