Use a more secure cryptographic hashing function for password instead of the current MD5

[allanbenW]

Introduction

NebulaGraph (as of v3.6.0) uses MD5 for password hashing

nebula/src/graph/executor/admin/CreateUserExecutor.cpp

Line 24 in de9b3ed

proxygen::md5Encode(folly::StringPiece(*cuNode->password())),

However, MD5 is known to have a broken collision resistance and is vulnerable to collision attacks. There are also published theoretical attacks against its preimage resistance.

Contents

Use a cryptographically secure hashing function, such as bcrypt

Related work

[wey-gu]

Welcome @allanbenW to the community and thanks for pointing this out!

@dutor @MuYiYong

[allanbenW]

Hi team. Just wondering if there's any plan addressing this security concern soon? maybe next (few) minor/major release?

[allanbenW]

bump again

apologize for ping, just trying to get some attention
@wey-gu @dutor

this is a security concern flagged by our security team, and it's blocking our adoption of this otherwise amazing solution