New Bcrypt credentials enables DoS attack on the protocol adapters.

As per Credentials API, Hono is using Spring security for Bcrypt password encoding.

Spring security supports bcrypt password encoding with log rotations from 4 to 31, 10 being default (i.e:- 2^10 hash iterations). Once hashed, the log rotation used is part of the password like

$2a$21$LQdzaDSINBpHmYRiGEVtkOVt2GScZ6bPvEyoAIpiVIE6F4rviemdm

where $21 represents the log rotation used. There is currently no max limit defined in Hono. If a user, say stores the password with higher rotation, then it could enable a DOS attack on the adapters.

I tested the time taken for BCryptPasswordEncoder.matches with higher log rotation on my laptop (Intel Core i7 - 2.7GHz 8 core, 32 GB RAM) it took

• 10 - 105 milliseconds
• 12 - 360 milliseconds
• 18 - 21 seconds
• 21 - 178 seconds
• 31 - more than 1 hour and I had to abort it.

Setting 31 as log rotation will definitely block the protocol adapters.

As a best practise, I would restrict the log rotation to 12 or 14, document them as part of credentials API and have this checked in

org.eclipse.hono.util.CredentialsObject.hasValidSecrets()

[balsmn]

@sophokles73 yes I can work on this PR sometime next week.

[balsmn]

oh, I was about to start this now. Anyways. Thanks.