-
Notifications
You must be signed in to change notification settings - Fork 594
feat(general): User_profile_add_set cli changes #3770
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
feat(general): User_profile_add_set cli changes #3770
Conversation
Codecov ReportAttention: Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## master #3770 +/- ##
==========================================
+ Coverage 75.86% 76.93% +1.06%
==========================================
Files 470 476 +6
Lines 37301 28943 -8358
==========================================
- Hits 28299 22266 -6033
+ Misses 7071 4736 -2335
- Partials 1931 1941 +10 ☔ View full report in Codecov by Sentry. |
| type scryptKeyDeriver struct { | ||
| // n scryptCostParameterN is scrypt's CPU/memory cost parameter. | ||
| n int | ||
| // r scryptCostParameterR is scrypt's work factor. | ||
| r int | ||
| // p scryptCostParameterP is scrypt's parallelization parameter. | ||
| p int |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thank you for adding these comments!
|
@bathina2 Sirish, changes look very good. Took first pass and left some comments, please take look. This is looking very close to done. |
internal/user/user_profile.go
Outdated
| // compare against valid user to avoid revealing whether the user account exists. | ||
| isValidPassword(password, dummyV1HashThatNeverMatchesAnyPassword, crypto.DefaultKeyDerivationAlgorithm) | ||
|
|
||
| isValidPassword(password, dummyV1HashThatNeverMatchesAnyPassword, algorithms[rand.Intn(len(algorithms))]) |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thank you!
|
Looks good now pending some linters cleanup that @bathina2 is looking into. I'll just hold on to Jarek/Julio to respond to my comment until afternoon (pacific time), then we can take this in. |
Shrekster
left a comment
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM 👍
Merging this. @julio-lopez / @jkowalski PTAL at my comment regarding user profiles post merge as well.
…3821) Code movement and simplification, no functional changes. Objectives: - Allow callers specifying the needed key (or hash) size, instead of hard-coding it in the registered PBK derivers. Conceptually, the caller needs to specify the key size, since that is a requirement of the (encryption) algorithm being used in the caller. Now, the code changes here do not result in any functional changes since the key size is always 32 bytes. - Remove a global definition for the default PB key deriver to use. Instead, each of the 3 use case sets the default value. Changes: - `crypto.DeriveKeyFromPassword` now takes a key size. - Adds new constants for the key sizes at the callers. - Removes the global `crypto.MasterKeySize` const. - Removes the global `crypto.DefaultKeyDerivationAlgorithm` const. - Adds const for the default derivation algorithms for each use case. - Adds a const for the salt length in the `internal/user` package, to ensure the same salt length is used in both hash versions. - Unexports various functions, variables and constants in the `internal/crypto` & `internal/user` packages. - Renames various constants for consistency. - Removes unused functions and symbols. - Renames files to be consistent and better reflect the structure of the code. - Adds a couple of tests to ensure the const values are in sync and supported. - Fixes a couple of typos Followups to: - #3725 - #3770 - #3779 - #3799 - #3816 The individual commits show the code transformations to simplify the review of the changes.
This PR allows users to set the key derivation algorithm in a profile.
The previous control
user-password-hash-versionwas in place to handle any variations, however it has only ever supported 1 version and is not quite accurate. It has been replace withkey-derivation-algorithm.There is support to handle older profiles that have the PasswordHashVersion set. It will default to using the
Scryptkey derivation algorithm as it had in the past.An example where a profile is created with the old changes and one that is created with these new ones-