Is there anyway to change the hash algorithm use to encrypt ColdFusion Administrator password?

[john85]

It looks like the ColdFusion Administrator password in the password.properties file is currently encrypted using SHA-1. Is there anyway to change this setting to say SHA-256?

[Dave Watts]

Not that I'm aware of. But if someone can access that file, you have far more serious problems than the encryption for the password.

Dave Watts, CTO, Fig Leaf Software

[john85]

No one can access that file (it pretty much locked to the outside world, at least to my knowledge). I am just basically looking to see if ColdFusion "supported" SHA-256 hash algorithm. I know the hash function support SHA-256 and so forth, not sure if ColdFusion itself support SHA-256 hash algorithm (where ever it calculate hash value).

Thanks!

[Dave Watts]

The CF Administrator is just a CF application itself. When you say that the hash function supports SHA-256, that means that ColdFusion itself supports SHA-256. To the best of my knowledge, CF doesn't calculate hashes in any meaningful sense unless instructed to by a CF application.

Dave Watts, CTO, Fig Leaf Software

[pete_freitag]

John,  The encrypt function does not support SHA-256 as an algorithm because it is a hash algorithm not an encryption algorithm. The Hash function does support SHA-256, along with several others, see the docs: http://cfdocs.org/hash and http://cfdocs.org/encrypt

Not trying to be nit picky but there is a big difference betwen hashing a string and encrypting it, and that difference is when you encrypt it you can get the original string back by decrypting. Hash algorithms are designed not to be reversable, which makes them good for storing passwords.

[john85]

Peter,

It is another case of finger moving faster than the brain, SHA is a hash not an encryption algorithm. I have a client that is moving toward SHA-256 hash and want to make sure ColdFusion support it. We have code that use hash function but has function does supported SHA-256 so that is fine. I am just wondering if there is any other place in ColdFusion (such as password.properties, configuration, etc) that use hash. If there is, I was wondering if there is a way to change it.

Thanks,

John

[john85]

I guess I should reword my question.

Let say for CFLDAP, if the AD server certificate is signed using sha256RSA hash algorithm, does ColdFusion support it? I guess, this question is more like a Java question, as the AD cert is import using java keytool.