X-Git-Url: https://git.openstreetmap.org./rails.git/blobdiff_plain/56fd5c4d90c7d3757fb97ff16c40aaa307ae1d22..a128b4f585cb2f75ad1057d0b7c5af6713ed4186:/lib/password_hash.rb?ds=sidebyside diff --git a/lib/password_hash.rb b/lib/password_hash.rb index 5adfc7a34..325955cf1 100644 --- a/lib/password_hash.rb +++ b/lib/password_hash.rb @@ -1,55 +1,46 @@ -require "securerandom" -require "openssl" +require "argon2" require "base64" require "digest/md5" +require "openssl" +require "securerandom" module PasswordHash - SALT_BYTE_SIZE = 32 - HASH_BYTE_SIZE = 32 - PBKDF2_ITERATIONS = 1000 - DIGEST_ALGORITHM = "sha512" + FORMAT = Argon2::HashFormat.new(Argon2::Password.create("")) def self.create(password) - salt = SecureRandom.base64(SALT_BYTE_SIZE) - hash = self.hash(password, salt, PBKDF2_ITERATIONS, HASH_BYTE_SIZE, DIGEST_ALGORITHM) - return hash, [DIGEST_ALGORITHM, PBKDF2_ITERATIONS, salt].join("!") + hash = Argon2::Password.create(password) + [hash, nil] end def self.check(hash, salt, candidate) - if salt.nil? - candidate = Digest::MD5.hexdigest(candidate) - elsif salt =~ /!/ + if Argon2::HashFormat.valid_hash?(hash) + Argon2::Password.verify_password(candidate, hash) + elsif salt.nil? + ActiveSupport::SecurityUtils.secure_compare(hash, Digest::MD5.hexdigest(candidate)) + elsif salt.include?("!") algorithm, iterations, salt = salt.split("!") size = Base64.strict_decode64(hash).length - candidate = self.hash(candidate, salt, iterations.to_i, size, algorithm) + ActiveSupport::SecurityUtils.secure_compare(hash, pbkdf2(candidate, salt, iterations.to_i, size, algorithm)) else - candidate = Digest::MD5.hexdigest(salt + candidate) + ActiveSupport::SecurityUtils.secure_compare(hash, Digest::MD5.hexdigest(salt + candidate)) end - - return hash == candidate end - def self.upgrade?(hash, salt) - if salt.nil? - return true - elsif salt =~ /!/ - algorithm, iterations, salt = salt.split("!") - return true if Base64.strict_decode64(salt).length != SALT_BYTE_SIZE - return true if Base64.strict_decode64(hash).length != HASH_BYTE_SIZE - return true if iterations.to_i != PBKDF2_ITERATIONS - return true if algorithm != DIGEST_ALGORITHM - else - return true - end + def self.upgrade?(hash, _salt) + format = Argon2::HashFormat.new(hash) - return false + format.variant != FORMAT.variant || + format.version != FORMAT.version || + format.t_cost != FORMAT.t_cost || + format.m_cost != FORMAT.m_cost || + format.p_cost != FORMAT.p_cost + rescue Argon2::ArgonHashFail + true end -private - - def self.hash(password, salt, iterations, size, algorithm) + def self.pbkdf2(password, salt, iterations, size, algorithm) digest = OpenSSL::Digest.new(algorithm) - pbkdf2 = OpenSSL::PKCS5::pbkdf2_hmac(password, salt, iterations, size, digest) + pbkdf2 = OpenSSL::PKCS5.pbkdf2_hmac(password, salt, iterations, size, digest) Base64.strict_encode64(pbkdf2) end end