Password encryption: Dropping Crypt::CipherSaber

[racke]

The old documentation says:

Authentication is based on passwords stored in the database table user_table; if the appropriate Crypt::CipherSaber is installed, passwords are encrypted in the database using reversible encryption based on RC4. Otherwise, they are stored in clear text. In both cases, reminding of passwords is possible.

But when I'm looking at my databases, I see only MD5 encryption. Note: I'm using Debian packages, but they
have a dependency on Crypt::CipherSaber.

[ikedas]

According to OChangelog, MD5 password hash was introduced on Sympa 6.0 (311cae8), and RC4 password encription was deprecated on Sympa 6.2 (a16fd3e).

Currently, RC4 is used only for encryption/decription of HTTP session cookie.

[ikedas]

• After all, Crypt::CipherSaber is no longer used to encrypt passwords.
• And I doubt if encryption of cookie values will make HTTP session more secure: Each randomized value can be reusable in the period of cookie_refresh.

So I suppose Crypt::CipherSaber would be better to be removed. If there is no objection, I'll submit a PR.

[ikedas]

6.2.26 introduced bcrypt password hash, then MD5 hash may be obsoleted: See also PR #225, #238.

On the other hand, password encrypted by RC4 is still supported. Thus I propose:

Proposal dropping Crypt::CipherSaber

1. Deprecation of RC4:
   • Password storage encrypted by RC4 would be deprecated.
   • Such passwords may be decrypted and hashed during upgrading process.
2. As well, giving up encryption of session ID in HTTP cookie: It hardly enhances security.
3. Finally, dropping a dependency module Crypt::Ciphersaber.

[ikedas]

PR above will drop Crypt::CipherSaber.