Skip to content

Conversation

@bathina2
Copy link
Contributor

@bathina2 bathina2 commented Apr 3, 2024

This PR allows users to set the key derivation algorithm in a profile.
The previous control user-password-hash-version was in place to handle any variations, however it has only ever supported 1 version and is not quite accurate. It has been replace with key-derivation-algorithm.

There is support to handle older profiles that have the PasswordHashVersion set. It will default to using the Scrypt key derivation algorithm as it had in the past.

An example where a profile is created with the old changes and one that is created with these new ones-

./kopianew2 server user list --json
[
 {"username":"tes2@test","passwordHashVersion":1,"passwordHash":"CE/3mjeFF6PnFYfXw7H6Lxq6MWG0TKLzKZ1C2cH5YIQSnVtL9gP8KpHmlK88BiA0qhXKUwOvPHgiumCDQUFmTw=="},
 {"username":"test3@test","keyDerivationAlgorithm":"scrypt-65536-8-1","passwordHash":"ksfKeB2hg4XlTzOxqvsU7mog9F/7x1Ca5Huj5KnGN4kzcV/Fj9ws0PJGtYZ254scDerHuoAJR6+IMbymK6p5Gg=="},
 
]            

@bathina2 bathina2 changed the title User_profile_add_set cli changes feat(general)-User_profile_add_set cli changes Apr 4, 2024
@bathina2 bathina2 changed the title feat(general)-User_profile_add_set cli changes feat(general): User_profile_add_set cli changes Apr 4, 2024
@codecov
Copy link

codecov bot commented Apr 5, 2024

Codecov Report

Attention: Patch coverage is 82.50000% with 7 lines in your changes are missing coverage. Please review.

Project coverage is 76.93%. Comparing base (cb455c6) to head (e35c71e).
Report is 100 commits behind head on master.

❗ Current head e35c71e differs from pull request most recent head 04c3f15. Consider uploading reports for the commit 04c3f15 to get more accurate results

Files Patch % Lines
internal/user/user_profile_hash_v1.go 78.94% 2 Missing and 2 partials ⚠️
cli/command_user_add_set.go 60.00% 1 Missing and 1 partial ⚠️
internal/crypto/key_derivation_testing.go 83.33% 0 Missing and 1 partial ⚠️
Additional details and impacted files
@@            Coverage Diff             @@
##           master    #3770      +/-   ##
==========================================
+ Coverage   75.86%   76.93%   +1.06%     
==========================================
  Files         470      476       +6     
  Lines       37301    28943    -8358     
==========================================
- Hits        28299    22266    -6033     
+ Misses       7071     4736    -2335     
- Partials     1931     1941      +10     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

Comment on lines +43 to +49
type scryptKeyDeriver struct {
// n scryptCostParameterN is scrypt's CPU/memory cost parameter.
n int
// r scryptCostParameterR is scrypt's work factor.
r int
// p scryptCostParameterP is scrypt's parallelization parameter.
p int
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you for adding these comments!

@Shrekster
Copy link
Collaborator

@bathina2 Sirish, changes look very good. Took first pass and left some comments, please take look. This is looking very close to done.

// compare against valid user to avoid revealing whether the user account exists.
isValidPassword(password, dummyV1HashThatNeverMatchesAnyPassword, crypto.DefaultKeyDerivationAlgorithm)

isValidPassword(password, dummyV1HashThatNeverMatchesAnyPassword, algorithms[rand.Intn(len(algorithms))])
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you!

@Shrekster
Copy link
Collaborator

Shrekster commented Apr 10, 2024

Looks good now pending some linters cleanup that @bathina2 is looking into. I'll just hold on to Jarek/Julio to respond to my comment until afternoon (pacific time), then we can take this in.

Copy link
Collaborator

@Shrekster Shrekster left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 👍

Merging this. @julio-lopez / @jkowalski PTAL at my comment regarding user profiles post merge as well.

@Shrekster Shrekster merged commit 5fa39fe into kopia:master Apr 11, 2024
@Shrekster Shrekster deleted the profile_hash_version_changes branch April 11, 2024 00:56
julio-lopez added a commit that referenced this pull request Apr 27, 2024
…3821)

Code movement and simplification, no functional changes.

Objectives:
- Allow callers specifying the needed key (or hash) size, instead of
hard-coding it in the registered PBK derivers. Conceptually, the caller
needs to specify the key size, since that is a requirement of the
(encryption) algorithm being used in the caller. Now, the code changes
here do not result in any functional changes since the key size is
always 32 bytes.
- Remove a global definition for the default PB key deriver to use.
Instead, each of the 3 use case sets the default value.

Changes:
- `crypto.DeriveKeyFromPassword` now takes a key size.
- Adds new constants for the key sizes at the callers.
- Removes the global `crypto.MasterKeySize` const.
- Removes the global `crypto.DefaultKeyDerivationAlgorithm` const.
- Adds const for the default derivation algorithms for each use case.
- Adds a const for the salt length in the `internal/user` package, to ensure
  the same salt length is used in both hash versions.
- Unexports various functions, variables and constants in the `internal/crypto`
  & `internal/user` packages.
- Renames various constants for consistency.
- Removes unused functions and symbols.
- Renames files to be consistent and better reflect the structure of the code.
- Adds a couple of tests to ensure the const values are in sync and supported.
- Fixes a couple of typos

Followups to:
- #3725
- #3770
- #3779
- #3799
- #3816

The individual commits show the code transformations to simplify the
review of the changes.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants