Password reset using an asymmetric encryption key pair
Disclosed herein are system, method, and computer program product embodiments for securely performing a password change. An embodiment operates by receiving a password change request from a user. The password change request comprises an encrypted version of a new password for the user, a cleartext version of the new password, and a login name for the user. The embodiment then executes a command from a password rotator user account with the cleartext version of the new password, the encrypted version of the new password, and the login name. The embodiment then retrieves a public key associated with the login name. The embodiment then determines, based on the public key, that the password change request comes from the user and that the cleartext version of the new password has not been modified. The embodiment then sets the password of a user login associated with the user to the new password.
1 . A computer-implemented method for securely performing a password change, comprising:
receiving a password change request from a user, wherein the password change request comprises an encrypted version of a new password for the user and a cleartext version of the new password;
executing a command from a password rotator user account with the cleartext version of the new password and the encrypted version of the new password;
determining, based on a public key associated with the user, that the password change request comes from the user and that the cleartext version of the new password has not been modified; and
setting a password of a user login associated with the user to the new password in response to the determining.
2 . The computer-implemented method of claim 1 , wherein the determining further comprises:
decrypting the encrypted version of the new password with the public key; and
determining that the decrypting was successful.
3 . The computer-implemented method of claim 1 , wherein the determining further comprises:
decrypting the encrypted version of the new password with the public key, thereby generating a decrypted version of the new password; and
determining that the decrypted version of the new password matches the cleartext version of the new password.
4 . The computer-implemented method of claim 1 , further comprising:
receiving a request to rotate the public key and a private key, wherein the request comprises a new public key for the user; and
updating the user login such that a current public key associated with the user login is replaced with the new public key.
5 . The computer-implemented method of claim 1 , wherein the public key and a private key are associated with a set of users comprising the user.
6 . The computer-implemented method of claim 1 , wherein the command is an extended Structured Query Language (SQL) command.
7 . The computer-implemented method of claim 1 , wherein the setting further comprises:
generating a hash of the new password in response to the determining; and
updating the user login such that a current password hash associated with the user login is replaced with the generated hash of the new password.
8 . A system for securely performing a password change, comprising:
a memory; and
at least one processor coupled to the memory and configured to:
receive a password change request from a user, wherein the password change request comprises an encrypted version of a new password for the user and a cleartext version of the new password;
execute a command from a password rotator user account with the cleartext version of the new password and the encrypted version of the new password;
determine, based on a public key associated with the user, that the password change request comes from the user and that the cleartext version of the new password has not been modified; and
set a password of a user login associated with the user to the new password in response to the determining.
9 . The system of claim 8 , wherein to determine that the password change request comes from the user and that the cleartext version of the new password has not been modified, the at least one processor is configured to:
decrypt the encrypted version of the new password with the public key; and
determine that the decrypting was successful.
10 . The system of claim 8 , wherein to determine that the password change request comes from the user and that the cleartext version of the new password has not been modified, the at least one processor is configured to:
decrypt the encrypted version of the new password with the public key, thereby generating a decrypted version of the new password; and
determine that the decrypted version of the new password matches the cleartext version of the new password.
11 . The system of claim 8 , wherein the at least one processor is further configured to:
receive a request to rotate the public key and a private key, wherein the request comprises a new public key for the user; and
update the user login such that a current public key associated with the user login is replaced with the new public key.
12 . The system of claim 8 , wherein the public key and a private key are associated with a set of users comprising the user.
13 . The system of claim 8 , wherein the command is an extended Structured Query Language (SQL) command.
14 . The system of claim 8 , wherein to set the password of the user login associated with the user to the new password, the at least one processor is configured to:
generate a hash of the new password in response to the determining; and
update the user login such that a current password hash associated with the user login is replaced with the generated hash of the new password.
15 . A non-transitory computer-readable device having instructions stored thereon that, when executed by at least one computing device, cause the at least one computing device to perform operations comprising:
receiving a password change request from a user, wherein the password change request comprises an encrypted version of a new password for the user and a cleartext version of the new password;
executing a command from a password rotator user account with the cleartext version of the new password and the encrypted version of the new password;
determining, based on a public key associated with the user, that the password change request comes from the user and that the cleartext version of the new password has not been modified; and
setting a password of a user login associated with the user to the new password in response to the determining.
16 . The non-transitory computer-readable device of claim 15 , wherein the determining further comprises:
decrypting the encrypted version of the new password with the public key; and
determining that the decrypting was successful.
17 . The non-transitory computer-readable device of claim 15 , wherein the determining further comprises:
decrypting the encrypted version of the new password with the public key, thereby generating a decrypted version of the new password; and
determining that the decrypted version of the new password matches the cleartext version of the new password.
18 . The non-transitory computer-readable device of claim 15 , wherein the operations further comprise:
receiving a request to rotate the public key and a private key, wherein the request comprises a new public key for the user; and
updating the user login such that a current public key associated with the user login is replaced with the new public key.
19 . The non-transitory computer-readable device of claim 15 , wherein the command is an extended Structured Query Language (SQL) command.
20 . The non-transitory computer-readable device of claim 15 , wherein the determining further comprises:
generating a hash of the new password in response to the determining; and
updating the user login such that a current password hash associated with the user login is replaced with the generated hash of the new password.