Replace Bouncy Castle's OpenBSDBCrypt used in password hashing and verification

[dancristiancecoi]

Is your feature request related to a problem?

Currently the password hashing and verification logic is built around Bouncy Castle's OpenBSDBCrypt. This will present a problem in FIPS enabled environments as BCrypt is not a FIPS compliant algorithm & the BouncyCastle provider itself is not FIPS enabled.

What solution would you like?

I propose we remove any references to OpenBSDBCrypt from the code & replace it with an implementation built around the Password4J library.

In my opinion these are the points in favor of Password4j:

• Open Source with an Apache License
• Actively maintained
• Supports BCrypt, Argon2, SCrypt, PBKDF2
• Straightforward API
• Backwards compatible (it can verify hashes generated by the current BouncyCastle/OpenBSDBCrypt implementation)
• Supports updating of existing hashes (to a more secure configuration or to an entirely different algorithm).
• Relatively popular

Do you have any additional context?

This will help towards the following issues:

• [RFC] Proposal for supporting FIPS 140-2 enforced mode #3420
• [FEATURE] Add support for PBKDF2 for passwords hashing #4079 (support for additional BCrypt configuration & additional algorithms (PBKDF2, SCrypt, Argon2) will be done in separate PR's

[dancristiancecoi]

Please assign to me once triaged.

[stephen-crawford]

[Triage] Hi @dancristiancecoi thanks for filing this issue. Looks good. Assigning to you as requested.