Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

crypt-blowfish salt is too short #12428

Merged
merged 11 commits into from
Dec 8, 2016
Merged

crypt-blowfish salt is too short #12428

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
11 commits
Select commit Hold shift + click to select a range
9e2667d
Fix the generation of salt for crypt-blowfish
photodude Oct 16, 2016
a0a50db
Pass hash crypt-blowfish without salt is length 60
photodude Oct 16, 2016
824ae34
Increase Cost Factor for crypt-blowfish
photodude Oct 16, 2016
c1be90c
Merge branch 'staging' into patch-9
photodude Oct 20, 2016
74c109c
Merge branch 'staging' into patch-9
photodude Nov 29, 2016
7a2373b
Merge branch 'staging' into patch-9
photodude Dec 3, 2016
44c17a0
Verify a pre-J3.2.1 crypt-blowfish without salt Password
photodude Dec 3, 2016
aa7e332
Improve the verification of a pre-J3.2.1 `getCryptedPassword()` Password
photodude Dec 3, 2016
6ba9c81
Merge branch 'staging' into patch-9
photodude Dec 4, 2016
9ed5d52
verify a pre-phpass password hash
photodude Dec 4, 2016
3f3ccb0
Add one test with existing hash from old method
photodude Dec 4, 2016
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 4 additions & 4 deletions libraries/joomla/user/helper.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -389,7 +389,7 @@ public static function verifyPassword($password, $hash, $user_id = 0)
}

/**
* Formats a password using the current encryption.
* Formats a password using the old encryption methods.
*
* @param string $plaintext The plaintext password to encrypt.
* @param string $salt The salt to use to encrypt the password. []
Expand Down Expand Up @@ -509,7 +509,7 @@ public static function getCryptedPassword($plaintext, $salt = '', $encryption =
}

/**
* Returns a salt for the appropriate kind of password encryption.
* Returns a salt for the appropriate kind of password encryption using the old encryption methods.
* Optionally takes a seed and a plaintext password, to extract the seed
* of an existing password, or for encryption types that use the plaintext
* in the generation of the salt.
Expand Down Expand Up @@ -569,11 +569,11 @@ public static function getSalt($encryption = 'md5-hex', $seed = '', $plaintext =
case 'crypt-blowfish':
if ($seed)
{
return substr(preg_replace('|^{crypt}|i', '', $seed), 0, 16);
return substr(preg_replace('|^{crypt}|i', '', $seed), 0, 30);
}
else
{
return '$2$' . substr(md5(JCrypt::genRandomBytes()), 0, 12) . '$';
return '$2y$10$' . substr(md5(JCrypt::genRandomBytes()), 0, 22) . '$';
}
break;

Expand Down
17 changes: 16 additions & 1 deletion tests/unit/suites/libraries/joomla/user/JUserHelperTest.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -357,6 +357,21 @@ public function testVerifyPassword()
JUserHelper::verifyPassword('mySuperSecretPassword', '693560686f4d591d8dd5e34006442061'),
'Properly verifies a password hashed with Joomla legacy MD5'
);

$password = 'mySuperSecretPassword';
// Generate the old style password hash used before phpass was implemented.
$salt = JUserHelper::genRandomPassword(32);
$crypted = JUserHelper::getCryptedPassword($password, $salt);
$hashed = $crypted.':'.$salt;
$this->assertTrue(
JUserHelper::verifyPassword('mySuperSecretPassword', $hashed),
'Properly verifies a password which was hashed before phpass was implemented'
);

$this->assertTrue(
JUserHelper::verifyPassword('mySuperSecretPassword', 'fb7b0a16d7e0e6706c0f962832e1fdd8:vQnUrofbvGRcBR6l502Bt8nioKj8MObh'),
'Properly verifies an existing password hash which was hashed before phpass was implimented'
);
}

/**
Expand Down Expand Up @@ -438,7 +453,7 @@ public function testGetCryptedPassword()
$this->assertSame('my', substr($password, 7, 2), 'Password hash uses expected salt');

$this->assertTrue(
strlen(JUserHelper::getCryptedPassword('mySuperSecretPassword', '', 'crypt-blowfish')) === 13,
strlen(JUserHelper::getCryptedPassword('mySuperSecretPassword', '', 'crypt-blowfish')) === 60,
'Password is hashed to crypt-blowfish without salt'
);

Expand Down