FoundKeyGang/FoundKey
FoundKeyGang
/
FoundKey
7
19
Fork 22
Code Issues 37 Pull Requests 4 Releases Activity

argon2 support #308

Merged
toast merged 5 commits from argon2 into main 2022-12-29 20:13:48 +00:00
Conversation 1 Commits 5 Files Changed 4 +106 -16
toast commented 2022-12-28 17:06:36 +00:00
Owner
Copy Link

Passwords will be automatically re-hashed on sign-in.
All new password hashes will be argon2 by default.

This uses argon2id and is not configurable (mostly since it's the default and I couldn't be bothered).
In the very unlikely case someone has more specific needs (e.g wants the additional resistance to side-channel attacks from using pure argon2i, or is worried about gpu attacks and wants to use argon2d), a fork is recommended (since there are many other parts of the codebase that would need significant modification).

Due to the change in attitude towards configurability, it's recommended this be squash-merged.

ChangeLog: Added

Passwords will be automatically re-hashed on sign-in. All new password hashes will be argon2 by default. This uses argon2id and is not configurable (mostly since it's the default and I couldn't be bothered). In the very unlikely case someone has more specific needs (e.g wants the additional resistance to side-channel attacks from using pure argon2i, or is worried about gpu attacks and wants to use argon2d), a fork is recommended (since there are many other parts of the codebase that would need significant modification). Due to the change in attitude towards configurability, it's recommended this be squash-merged. ChangeLog: Added
toast added 5 commits 2022-12-28 17:06:37 +00:00
ci/woodpecker/push/lint-client Pipeline was successful Details
ci/woodpecker/push/lint-backend Pipeline was successful Details
ci/woodpecker/push/build Pipeline was successful Details
ci/woodpecker/push/lint-foundkey-js Pipeline was successful Details
ci/woodpecker/push/lint-sw Pipeline was successful Details
ci/woodpecker/push/test Pipeline was successful Details
71c6eaa66e backend: add support for argon2id hashes 
Still TODO: automatically rehash passwords on login, somehow.

ChangeLog: Added
ci/woodpecker/push/lint-backend Pipeline was successful Details
ci/woodpecker/push/build Pipeline was successful Details
ci/woodpecker/push/lint-client Pipeline was successful Details
ci/woodpecker/push/lint-foundkey-js Pipeline was successful Details
ci/woodpecker/push/lint-sw Pipeline was successful Details
ci/woodpecker/push/test Pipeline was successful Details
80042d9b77 fixup! backend: add support for argon2id hashes
ci/woodpecker/push/lint-client Pipeline was successful Details
ci/woodpecker/push/lint-foundkey-js Pipeline was successful Details
ci/woodpecker/push/build Pipeline was successful Details
ci/woodpecker/push/lint-backend Pipeline was successful Details
ci/woodpecker/push/lint-sw Pipeline was successful Details
ci/woodpecker/push/test Pipeline was successful Details
ci/woodpecker/pr/lint-foundkey-js Pipeline was successful Details
ci/woodpecker/pr/lint-client Pipeline failed Details
ci/woodpecker/pr/lint-backend Pipeline failed Details
ci/woodpecker/pr/build Pipeline was successful Details
ci/woodpecker/pr/lint-sw Pipeline failed Details
ci/woodpecker/pr/test Pipeline failed Details
520ae2fc61 backend: automatically rehash old algorithm passwords on signin
Johann150 reviewed 2022-12-28 20:28:09 +00:00
packages/backend/src/server/api/private/signin.ts
@ -69,6 +69,11 @@ export default async (ctx: Koa.Context) => {
// Compare password
const same = await comparePassword(password, profile.password!);
if (same && isOldAlgorithm(profile.password!)) {
Johann150 commented 2022-12-28 20:28:09 +00:00
Owner
Copy Link

I'm not sure if putting this here before potential other checks doesn't make it susceptible to timing attacks?

I'm not sure if putting this here before potential other checks doesn't make it susceptible to timing attacks?
toast commented 2022-12-29 20:11:58 +00:00
Author
Owner
Copy Link

same is a static check and short circuits.
If same is true, the login would already be successful.
The only difference in timing would be in case of successful validation, in which case it's also static except for ONE time when the hash is updated (and it's already updated by the time you can figure that out).

`same` is a static check and short circuits. If `same` is true, the login would already be successful. The only difference in timing would be in case of successful validation, in which case it's also static except for ONE time when the hash is updated (and it's already updated by the time you can figure that out).
toast commented 2022-12-29 20:11:59 +00:00
Author
Owner
Copy Link

same is a static check and short circuits.
If same is true, the login would already be successful.
The only difference in timing would be in case of successful validation, in which case it's also static except for ONE time when the hash is updated (and it's already updated by the time you can figure that out).

`same` is a static check and short circuits. If `same` is true, the login would already be successful. The only difference in timing would be in case of successful validation, in which case it's also static except for ONE time when the hash is updated (and it's already updated by the time you can figure that out).
toast marked this conversation as resolved
Johann150 commented 2022-12-28 20:39:03 +00:00
Owner
Copy Link

Other than the comment above seems fine to me.

Other than the comment above seems fine to me.
Johann150 added a new dependency 2022-12-28 20:41:38 +00:00
#302 Improve password hashing algorithm being used
toast merged commit ed9d4023d4 into main 2022-12-29 20:13:48 +00:00
toast referenced this issue from a commit 2022-12-29 20:13:48 +00:00
backend: add argon2 support
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
feature

task that proposes new feature(s)

  
fix

task to fix behavioral problems in the FoundKey codebase

  
upkeep

task that should make FoundKey smaller and more maintainable

No Label
feature
fix
upkeep
Milestone
Clear milestone
No items
No Milestone
Assignees
Clear assignees
No Assignees
2 Participants
Notifications
Due Date
The due date is invalid or out of range. Please use the format 'yyyy-mm-dd'.

No due date set.

Blocks
#302 Improve password hashing algorithm being used
FoundKeyGang/FoundKey
Reference: FoundKeyGang/FoundKey#308
No description provided.
Delete Branch "argon2"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?