Registry configuration only supports bcrypt password format

[iammichelleau]

The Registry configuration doc mentions the following:

The htpasswd authentication backed allows you to configure basic authentication using an Apache htpasswd file. The only supported password format is bcrypt. Entries with other hash types are ignored.

https://github.com/distribution/distribution/blob/5fe693474eb91a07d928b45477898ecf7a612582/docs/configuration.md#htpasswd

Curious to learn, why is the only supported password format bcrypt? Is there a reason why SHA-256/SHA-512 are not supported?

[milosgajdos]

From apache docs:

htpasswd encrypts passwords using either bcrypt, a version of MD5 modified for Apache, SHA1, or the system's crypt() routine. Files managed by htpasswd may contain a mixture of different encoding types of passwords; some user records may have bcrypt or MD5-encrypted passwords while others in the same file may have passwords encrypted with crypt().

SHA1 has been proven to have collisions, so it makes sense to not support that.

[iammichelleau]

Thanks for the response! Apache htpasswd file can manage a mixture of different password types, but the Registry specifically requires bcrypt. It sounds like this choice was made to maximize security and avoid collisions. Are there plans to accept other formats at all?

For context, there's a requirement for the application I'm working on to be FIPS compliant. bcrypt is not compliant, so just trying to learn more about the motivation behind the choice and see if there are any ways to work around it. A quick search seems to show that if the goal is to be FIPS compliant, there's currently no workaround, other than to remove the dependency on bcrypt.

[Jamstah]

It probably doesn't matter for fips if the hashes never leave the host. See https://bugzilla.redhat.com/show_bug.cgi?id=1486889#c16.

[milosgajdos]

I dont know much about apache and httpasswd, unfortunately, so can't comment on "different password types" only on what I can read in the docs which only mention brcypt, md5 and crypt 😄

I suspect it was chosen based on the docs by someone back in the day when the registry was created. We have no plans to expand the support for other formats if possible.