Comments (6)
If you'd still like to support the rscrypt
format with the latest versions of the scrypt
crate, the code to parse an rscrypt
hash and upgrade it to a PHC PasswordHash
can be found here:
fn upgrade_mcf_hash<'a>(&self, hash: &'a str) -> Result<PasswordHash<'a>> {
let mut parts = hash.split('$');
let buf = [
parts.next(),
parts.next(),
parts.next(),
parts.next(),
parts.next(),
parts.next(),
parts.next(),
parts.next(),
];
let (log_n, r, p, salt, hash) = match buf {
[Some(""), Some("rscrypt"), Some("0"), Some(p), Some(s), Some(h), Some(""), None] => {
let pvec = Base64::decode_vec(p)?;
if pvec.len() != 3 {
return Err(InvalidValue::Malformed.param_error());
}
(pvec[0], pvec[1] as u32, pvec[2] as u32, s, h)
}
[Some(""), Some("rscrypt"), Some("1"), Some(p), Some(s), Some(h), Some(""), None] => {
let pvec = Base64::decode_vec(p)?;
if pvec.len() != 9 {
return Err(InvalidValue::Malformed.param_error());
}
let log_n = pvec[0];
let r = u32::from_le_bytes(pvec[1..5].try_into().unwrap());
let p = u32::from_le_bytes(pvec[5..9].try_into().unwrap());
(log_n, r, p, s, h)
}
_ => return Err(InvalidValue::Malformed.param_error()),
};
let params = Params::new(log_n, r, p).map_err(|_| InvalidValue::Malformed.param_error())?;
let salt = Salt::new(b64_strip(salt))?;
let hash = Output::b64_decode(b64_strip(hash))?;
Ok(PasswordHash {
algorithm: ALG_ID,
version: None,
params: params.try_into()?,
salt: Some(salt),
hash: Some(hash),
})
}
from password-hashes.
You'll need to use the McfHasher::upgrade_mcf_hash
impl on Scrypt
to upgrade them to PHC hashes:
https://docs.rs/scrypt/0.7.0/scrypt/struct.Scrypt.html#method.upgrade_mcf_hash
Note that "rscrypt" is a nonstandard format which was supported only by the scrypt
crate.
from password-hashes.
Would it make sense to check if the hash starts with $rscrypt$
, and upgrade it using upgrade_mcf_hash()
only if it does?
from password-hashes.
Edit: sorry, I think I misunderstood your question.
Would it make sense to check if the hash starts with
$rscrypt$ , and upgrade it using upgrade_mcf_hash() only if it does?
Yes, that's a perfectly valid way to do an upgrade. You can even do that eagerly across all of your password hashes, as it's a lossless transformation which doesn't require a password.
from password-hashes.
Thanks, this makes sense. I will close the issue.
Unfortunately, I have customers with their own databases containing rscrypt hashes, and forcing them to upgrade may be problematic. So, supporting rscrypt hashes for quite some time is very important to me.
from password-hashes.
Thanks, much appreciated!
from password-hashes.
Related Issues (20)
- implement sha256_crypt HOT 2
- implement password_hash's traits for sha_crypt HOT 1
- Argon2: ergonomics as KDF HOT 4
- blake2 dep has been yanked HOT 5
- Ability to zeroize Output HOT 2
- Update argon2 default Params to match OWASP Cheat Sheet HOT 5
- argon2: clarify unit of m_cost is 1KiB in documentation
- Rustify the argon2 API HOT 3
- argon2: parallel memory view abstraction HOT 1
- argon2: SaltInvalid(TooLong) for existing password hashes HOT 2
- different results on .NET Rfc2898DeriveBytes HOT 6
- the rust argon2 implementation is ~76 times slower than the golang implementation HOT 1
- Why does my salt appear in the generated hash? HOT 1
- [`argon2`]: unresolved import `argon2::password_hash::rand_core::OsRng` HOT 1
- Output max length : 86 instead of 64 HOT 2
- scrypt params are too restrictive HOT 3
- Is `Argon2::default()` forward compatible? HOT 1
- password-auth: provide an API to expose whether a password should be re-hashed HOT 4
- argon2: const ParamsBuilder HOT 5
- PBKDF2 defult number of rounds not correct? HOT 2
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from password-hashes.