upd: use scrypt for new passwords.

diff --git a/src/org/cacert/gigi/util/PasswordHash.java b/src/org/cacert/gigi/util/PasswordHash.java
index aaff22686389c974b7b856e9914f11a91d104146..d6b0b9066b7ab11ec72177e883f1156227fc3ce7 100644 (file)
--- a/src/org/cacert/gigi/util/PasswordHash.java
+++ b/src/org/cacert/gigi/util/PasswordHash.java
@@ -3,9 +3,14 @@ package org.cacert.gigi.util;
 import java.security.MessageDigest;
 import java.security.NoSuchAlgorithmException;
 
+import com.lambdaworks.crypto.SCryptUtil;
+
 public class PasswordHash {
 
     public static boolean verifyHash(String password, String hash) {
+        if (hash.contains("$")) {
+            return SCryptUtil.check(password, hash);
+        }
         String newhash = sha1(password);
         boolean match = true;
         if (newhash.length() != hash.length()) {
@@ -33,6 +38,6 @@ public class PasswordHash {
     }
 
     public static String hash(String password) {
-        return sha1(password);
+        return SCryptUtil.scrypt(password, 1 << 14, 8, 1);
     }
 }