1
1
mirror of https://github.com/go-gitea/gitea synced 2025-01-22 07:34:26 +00:00
Gusted 623c93ff46
Increase Salt randomness (#18179)
- The current implementation of `RandomString` doesn't give you a most-possible unique randomness. It gives you 6*`length` instead of the possible 8*`length` bits(or as `length`x bytes) randomness. This is because `RandomString` is being limited to a max value of 63, this in order to represent the random byte as a letter/digit.
- The recommendation of pbkdf2 is to use 64+ bit salt, which the `RandomString` doesn't give with a length of 10, instead of increasing 10 to a higher number, this patch adds a new function called `RandomBytes` which does give you the guarentee of 8*`length` randomness and thus corresponding of `length`x bytes randomness.
- Use hexadecimal to store the bytes value in the database, as mentioned, it doesn't play nice in order to convert it to a string. This will always be a length of 32(with `length` being 16).
- When we detect on `Authenticate`(source: db) that a user has the old format of salt, re-hash the password such that the user will have it's password hashed with increased salt.

Thanks to @zeripath for working out the rouge edges from my first commit 😄.

Co-authored-by: lafriks <lauris@nix.lv>
Co-authored-by: zeripath <art27@cantab.net>
2022-01-04 15:13:52 +00:00
..
2019-10-17 11:26:49 +02:00
2019-10-17 11:26:49 +02:00
2019-10-17 11:26:49 +02:00
2019-10-17 11:26:49 +02:00
2019-10-17 11:26:49 +02:00
2019-10-17 11:26:49 +02:00
2019-10-17 11:26:49 +02:00
2020-03-22 11:12:55 -04:00
2019-10-17 11:26:49 +02:00
2019-10-17 11:26:49 +02:00
2019-10-17 11:26:49 +02:00
2019-10-17 11:26:49 +02:00
2019-10-17 11:26:49 +02:00
2019-10-17 11:26:49 +02:00
2019-10-17 11:26:49 +02:00
2019-10-17 11:26:49 +02:00
2019-10-17 11:26:49 +02:00
2019-10-17 11:26:49 +02:00
2019-10-17 11:26:49 +02:00
2019-10-17 11:26:49 +02:00
2019-11-12 16:33:34 +08:00
2020-03-22 11:12:55 -04:00
2021-11-09 20:57:58 +01:00
2020-01-13 18:33:46 +01:00
2020-03-09 00:08:05 +02:00
2020-04-01 01:14:46 -03:00
2020-05-15 15:05:18 +01:00
2021-01-28 23:58:33 +01:00
2020-09-20 00:44:55 +08:00
2021-02-20 15:02:39 +01:00
2021-01-29 23:52:13 +08:00
2021-02-11 18:32:25 +01:00
2021-03-24 19:27:22 +01:00
2021-03-24 19:27:22 +01:00
2021-04-08 18:25:57 -04:00
2021-04-14 14:02:12 +02:00
2021-06-23 17:12:38 -04:00
2021-06-23 17:12:38 -04:00
2021-06-25 16:28:55 +02:00
2021-09-08 17:19:30 +02:00
2021-09-29 22:53:12 +02:00
2021-12-20 18:58:38 +01:00
2022-01-04 15:13:52 +00:00