From c3b5b5f648d953307672a4b30e9222787668f708 Mon Sep 17 00:00:00 2001 From: "Jason A. Donenfeld" Date: Sat, 14 Jul 2018 03:32:00 +0200 Subject: auth-filters: do not use HMAC-SHA1 Though SHA1 is broken, HMAC-SHA1 is still fine. But let's not push our luck; SHA256 is more sensible anyway. Signed-off-by: Jason A. Donenfeld --- filters/gentoo-ldap-authentication.lua | 4 ++-- filters/simple-authentication.lua | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) (limited to 'filters') diff --git a/filters/gentoo-ldap-authentication.lua b/filters/gentoo-ldap-authentication.lua index 6d8eb3e..c1e382f 100644 --- a/filters/gentoo-ldap-authentication.lua +++ b/filters/gentoo-ldap-authentication.lua @@ -271,7 +271,7 @@ function validate_value(expected_field, cookie) end -- Lua hashes strings, so these comparisons are time invariant. - if hmac ~= crypto.hmac.digest("sha1", field .. "|" .. value .. "|" .. tostring(expiration) .. "|" .. salt, secret) then + if hmac ~= crypto.hmac.digest("sha256", field .. "|" .. value .. "|" .. tostring(expiration) .. "|" .. salt, secret) then return nil end @@ -296,7 +296,7 @@ function secure_value(field, value, expiration) value = url_encode(value) field = url_encode(field) authstr = field .. "|" .. value .. "|" .. tostring(expiration) .. "|" .. salt - authstr = authstr .. "|" .. crypto.hmac.digest("sha1", authstr, secret) + authstr = authstr .. "|" .. crypto.hmac.digest("sha256", authstr, secret) return authstr end diff --git a/filters/simple-authentication.lua b/filters/simple-authentication.lua index de34d09..596c041 100644 --- a/filters/simple-authentication.lua +++ b/filters/simple-authentication.lua @@ -231,7 +231,7 @@ function validate_value(expected_field, cookie) end -- Lua hashes strings, so these comparisons are time invariant. - if hmac ~= crypto.hmac.digest("sha1", field .. "|" .. value .. "|" .. tostring(expiration) .. "|" .. salt, secret) then + if hmac ~= crypto.hmac.digest("sha256", field .. "|" .. value .. "|" .. tostring(expiration) .. "|" .. salt, secret) then return nil end @@ -256,7 +256,7 @@ function secure_value(field, value, expiration) value = url_encode(value) field = url_encode(field) authstr = field .. "|" .. value .. "|" .. tostring(expiration) .. "|" .. salt - authstr = authstr .. "|" .. crypto.hmac.digest("sha1", authstr, secret) + authstr = authstr .. "|" .. crypto.hmac.digest("sha256", authstr, secret) return authstr end -- cgit 1.4.1 /div>
Commit message (Expand)Author
2020-02-12Allow for arguments to open/copy utilitiesJune McEnroe
2020-02-12Handle RPL_AWAYJune McEnroe
2020-02-11Support monochromatic terminalsJune McEnroe
2020-02-11Add .gz to chroot-man scriptJune McEnroe
2020-02-11Add -R restricted flagJune McEnroe
2020-02-11Add chroot targetJune McEnroe
2020-02-11Exit focus and paste modes on err exitJune McEnroe
2020-02-11Add startup GPLv3 note and URLJune McEnroe
2020-02-11Make sure -D_GNU_SOURCE ends up in CFLAGS on LinuxJune McEnroe
2020-02-11Add note about setting PKG_CONFIG_PATHJune McEnroe
2020-02-11Rename query ID on nick changeJune McEnroe
2020-02-11Call completeClear when closing a windowJune McEnroe
2020-02-11Don't insert color codes for non-mentionsJune McEnroe
2020-02-11Take first two words in colorMentionsJune McEnroe
2020-02-11Use time_t for save signatureJune McEnroe
2020-02-11Set self.nick to * initiallyJune McEnroe
2020-02-11Define ColorCap instead of hardcoding 100June McEnroe
2020-02-11Move hash to top of chat.hJune McEnroe
2020-02-11Move base64 out of chat.hJune McEnroe
2020-02-11Move XDG_SUBDIR out of chat.hJune McEnroe
2020-02-11Fix whois idle unit calculationJune McEnroe
2020-02-11Cast towupper to wchar_tJune McEnroe
2020-02-11Cast set but unused variables to voidJune McEnroe
2020-02-11Declare strlcatJune McEnroe
2020-02-11Check if VDSUSP existsJune McEnroe
2020-02-11Fix completeReplace iterationJune McEnroe
2020-02-11Use pkg(8) to configure on FreeBSDJune McEnroe
2020-02-11Remove legacy codeJune McEnroe
2020-02-11Add INSTALLING section to READMEJune McEnroe