Eventually you will need to upgrade the crypto – Giovanni Collazo

[ad_1]

Every hashing and encryption algorithm will eventually become vulnerable and out of date. Before that happens, you need to stay ahead of the curve and use something known to protect your sensitive data.

When the algorithm you are using becomes vulnerable, you should act quickly and replace it as soon as possible to minimize the window of exposure. Replacing your current algorithm can be a daunting task if you haven’t prepared for the change.

We need to design systems of change.

Recently I had to upgrade an encryption library while keeping the old library for backward compatibility. The new library gave us some flexibility; the old one didn’t. However, the underlying algorithms have remained the same.

The idea was that whenever we needed to decrypt old data, we would re-encrypt it using the new library. This way, we were able to gradually migrate to the new library without interruption. We needed a way to encode the library we were using with each data item to decide which library we should use to decrypt and whether we should migrate that data to the new library format.

Faced with this challenge, I remembered how Django encoded passwords for database storage.

$$$

They encode the algorithm and other information needed to recreate the hash of the password in a string. Then, when a user enters a password, you can quickly analyze that string and get all the information needed to validate the hash and decide whether the hash needs an upgrade.

It’s a simple idea that works really well.

So I wrote this article to remind you and me that we need to add a version prefix whenever we need to store a password hash or encrypted data. That way when we need to migrate, we are ready to do so.

Photo: Unsplash

[ad_2]