Password Security Design

The V3NITY PaaS API implements a defense-in-depth security model for credential management. This document details the cryptographic standards, validation logic, and session safety protocols used to protect user accounts across the ecosystem.

Server-Side Hashing Architecture

To protect against offline attacks and data breaches, the system utilizes a high-iteration key derivation function. Raw passwords are never stored; instead, a cryptographically strong derived key is persisted.

1. Salt Generation A unique 16-byte cryptographically secure random salt is generated.
↓
2. Key Derivation (PBKDF2) The password and salt are processed through 10,240 iterations of HMAC-SHA1.
↓
3. Storage The resulting 512-bit hash and salt are stored as a 160-character hex string.
🛡️

Cryptographic Strength

By using PBKDF2 with a high iteration count, the system significantly increases the computational cost of "brute-force" or "dictionary" attacks on the database.

Compliance and Validation Policies

The API enforces a suite of configurable complexity rules. These policies are validated during both password creation and update operations to ensure credential integrity.

Policy Description
Character Diversity Requirements for uppercase, lowercase, numeric, and special characters (!?<>@#$%).
Sequence & Repetition Blocks predictable patterns like 1234 or aaaa based on tenant-specific thresholds.
Identity Validation Mandatory Passwords cannot be the same as the username. The system also rejects passwords containing the user's display name.
Password History Critical The system maintains a secure history of previous hashes. New passwords must not exist in the user's history list.
Configurable Expiry Enforces periodic rotation. By default, passwords expire every 12 months (configurable per tenant).

Brute-Force Protection

The system actively monitors login attempts to prevent automated credential stuffing and brute-force attacks.

⚠️

Account Lockout Logic

  • Threshold: Accounts are locked after a configurable number of consecutive failed attempts.
  • Duration: A cool-down period is enforced before the account is automatically unlocked.
  • Auditing: All lockout events are logged with the source IP and device information.

Transmission Security (RSA)

Passwords are protected during transit using Asymmetric RSA Encryption. This ensures end-to-end confidentiality even over potentially compromised networks.

1. Handshake Client retrieves the server's RSA Public Key.
↓
2. Encryption The raw password is encrypted locally using the RSA key.
↓
3. Submission The encrypted payload is transmitted to the /auth/login endpoint.

Session Management (Stay Logged On)

The "Stay Logged On" feature utilizes a secure dual-token architecture to provide a seamless yet safe user experience.

Feature Implementation Logic
Refresh Tokens A long-lived refresh token is issued upon successful login and stored in secure local storage.
7-Day Decision The user's preference to stay logged on is valid for 7 days, after which the prompt is reset.
Proactive Renewal The portal automatically renews the access token upon visit and periodically in the background.

Multi-Factor Authentication (MFA)

The system supports TOTP (Time-Based One-Time Password) as a secondary authentication factor.

📱

Standard Compatibility

The MFA implementation is compatible with Microsoft Authenticator and Google Authenticator. Users scan a QR code to link their device and must provide a 6-digit code for every login.