cst1/openstreetmap-website
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Switch to Argon2 for password hashing

Browse source
This commit is contained in:
Tom Hughes 2021-10-27 19:11:26 +01:00
parent c2d6a3090c
commit aad81eb74c
4 changed files with 55 additions and 31 deletions
Download patch file Download diff file Expand all files Collapse all files

51
lib/password_hash.rb
View file

@ -1,51 +1,44 @@
require "securerandom"
require "openssl"
require "argon2"
require "base64"
require "digest/md5"
require "openssl"
require "securerandom"
module PasswordHash
SALT_BYTE_SIZE = 32
HASH_BYTE_SIZE = 32
PBKDF2_ITERATIONS = 10000
DIGEST_ALGORITHM = "sha512".freeze
FORMAT = Argon2::HashFormat.new(Argon2::Password.create(""))
def self.create(password)
salt = SecureRandom.base64(SALT_BYTE_SIZE)
hash = self.hash(password, salt, PBKDF2_ITERATIONS, HASH_BYTE_SIZE, DIGEST_ALGORITHM)
[hash, [DIGEST_ALGORITHM, PBKDF2_ITERATIONS, salt].join("!")]
hash = Argon2::Password.create(password)
[hash, nil]
end
def self.check(hash, salt, candidate)
if salt.nil?
candidate = Digest::MD5.hexdigest(candidate)
if Argon2::HashFormat.valid_hash?(hash)
Argon2::Password.verify_password(candidate, hash)
elsif salt.nil?
hash == Digest::MD5.hexdigest(candidate)
elsif salt.include?("!")
algorithm, iterations, salt = salt.split("!")
size = Base64.strict_decode64(hash).length
candidate = self.hash(candidate, salt, iterations.to_i, size, algorithm)
hash == pbkdf2(candidate, salt, iterations.to_i, size, algorithm)
else
candidate = Digest::MD5.hexdigest(salt + candidate)
hash == Digest::MD5.hexdigest(salt + candidate)
end
hash == candidate
end
def self.upgrade?(hash, salt)
if salt.nil?
return true
elsif salt.include?("!")
algorithm, iterations, salt = salt.split("!")
return true if Base64.strict_decode64(salt).length != SALT_BYTE_SIZE
return true if Base64.strict_decode64(hash).length != HASH_BYTE_SIZE
return true if iterations.to_i != PBKDF2_ITERATIONS
return true if algorithm != DIGEST_ALGORITHM
else
return true
end
def self.upgrade?(hash, _salt)
format = Argon2::HashFormat.new(hash)
false
format.variant != FORMAT.variant ||
format.version != FORMAT.version ||
format.t_cost != FORMAT.t_cost ||
format.m_cost != FORMAT.m_cost ||
format.p_cost != FORMAT.p_cost
rescue Argon2::ArgonHashFail
true
end
def self.hash(password, salt, iterations, size, algorithm)
def self.pbkdf2(password, salt, iterations, size, algorithm)
digest = OpenSSL::Digest.new(algorithm)
pbkdf2 = OpenSSL::PKCS5.pbkdf2_hmac(password, salt, iterations, size, digest)
Base64.strict_encode64(pbkdf2)