forgejo/services
Gusted 623c93ff46
Increase Salt randomness (#18179)
- The current implementation of `RandomString` doesn't give you a most-possible unique randomness. It gives you 6*`length` instead of the possible 8*`length` bits(or as `length`x bytes) randomness. This is because `RandomString` is being limited to a max value of 63, this in order to represent the random byte as a letter/digit.
- The recommendation of pbkdf2 is to use 64+ bit salt, which the `RandomString` doesn't give with a length of 10, instead of increasing 10 to a higher number, this patch adds a new function called `RandomBytes` which does give you the guarentee of 8*`length` randomness and thus corresponding of `length`x bytes randomness.
- Use hexadecimal to store the bytes value in the database, as mentioned, it doesn't play nice in order to convert it to a string. This will always be a length of 32(with `length` being 16).
- When we detect on `Authenticate`(source: db) that a user has the old format of salt, re-hash the password such that the user will have it's password hashed with increased salt.

Thanks to @zeripath for working out the rouge edges from my first commit 😄.

Co-authored-by: lafriks <lauris@nix.lv>
Co-authored-by: zeripath <art27@cantab.net>
2022-01-04 15:13:52 +00:00
..
agit Move user related model into models/user (#17781) 2021-11-24 17:49:20 +08:00
asymkey Refactor auth package (#17962) 2022-01-02 21:12:35 +08:00
attachment Simplify parameter types (#18006) 2021-12-20 04:41:31 +00:00
auth Increase Salt randomness (#18179) 2022-01-04 15:13:52 +00:00
comments Move repository model into models/repo (#17933) 2021-12-10 09:27:50 +08:00
cron Some repository refactors (#17950) 2021-12-12 23:48:20 +08:00
externalaccount Refactor auth package (#17962) 2022-01-02 21:12:35 +08:00
forms Abort merge if head has been updated before pressing merge (#18032) 2021-12-20 08:32:54 +08:00
gitdiff Simplify parameter types (#18006) 2021-12-20 04:41:31 +00:00
issue Simplify parameter types (#18006) 2021-12-20 04:41:31 +00:00
lfs Move repository model into models/repo (#17933) 2021-12-10 09:27:50 +08:00
mailer Unify and simplify TrN for i18n (#18141) 2022-01-02 04:33:57 +01:00
migrations Do not read or write git reference files directly (#18079) 2021-12-23 21:44:00 +08:00
mirror Some repository refactors (#17950) 2021-12-12 23:48:20 +08:00
org Move repository model into models/repo (#17933) 2021-12-10 09:27:50 +08:00
pull Reset the conflicted files list in testpatch (#18139) 2021-12-31 20:33:55 +08:00
release Set HeadCommit when creating tags. (#18116) 2021-12-29 19:40:57 +08:00
repository services/repository: fix ListUnadoptedRepositories incorrect total count (#17865) 2022-01-01 10:52:00 +08:00
task Some repository refactors (#17950) 2021-12-12 23:48:20 +08:00
user Move keys to models/asymkey (#17917) 2021-12-10 16:14:24 +08:00
webhook Add issue hyperlinks in the webhook of wechatwork (#18102) 2021-12-25 21:30:09 +08:00
wiki Some repository refactors (#17950) 2021-12-12 23:48:20 +08:00