upstream/nextcloud
1
0
Fork 0
mirror of https://github.com/nextcloud/server.git synced 2026-06-09 08:44:07 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 11

Increase from 100000 to 600000 iterations for hash_pbkdf2

Browse source 
Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>
This commit is contained in:
Côme Chilliet 2023-05-11 17:20:44 +02:00
parent e90919b8de
commit 995a9b6435
No known key found for this signature in database
GPG key ID: A3E2F658B28C760A
1 changed files with 9 additions and 9 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

18
apps/encryption/lib/Crypto/Crypt.php
View file

@ -67,9 +67,9 @@ class Crypt {
// default cipher from old Nextcloud versions
public const LEGACY_CIPHER = 'AES-128-CFB';
public const SUPPORTED_KEY_FORMATS = ['hash', 'password'];
public const SUPPORTED_KEY_FORMATS = ['hash2', 'hash', 'password'];
// one out of SUPPORTED_KEY_FORMATS
public const DEFAULT_KEY_FORMAT = 'hash';
public const DEFAULT_KEY_FORMAT = 'hash2';
// default key format, old Nextcloud version encrypted the private key directly
// with the user password
public const LEGACY_KEY_FORMAT = 'password';
@ -373,22 +373,20 @@ class Crypt {
* @param string $uid only used for user keys
* @return string
*/
protected function generatePasswordHash($password, $cipher, $uid = '') {
protected function generatePasswordHash(string $password, string $cipher, string $uid = '', int $iterations = 600000): string {
$instanceId = $this->config->getSystemValue('instanceid');
$instanceSecret = $this->config->getSystemValue('secret');
$salt = hash('sha256', $uid . $instanceId . $instanceSecret, true);
$keySize = $this->getKeySize($cipher);
$hash = hash_pbkdf2(
return hash_pbkdf2(
'sha256',
$password,
$salt,
100000,
$iterations,
$keySize,
true
);
return $hash;
}
/**
@ -433,8 +431,10 @@ class Crypt {
$keyFormat = self::LEGACY_KEY_FORMAT;
}
if ($keyFormat === self::DEFAULT_KEY_FORMAT) {
$password = $this->generatePasswordHash($password, $cipher, $uid);
if ($keyFormat === 'hash') {
$password = $this->generatePasswordHash($password, $cipher, $uid, 100000);
} elseif ($keyFormat === 'hash2') {
$password = $this->generatePasswordHash($password, $cipher, $uid, 600000);
}
$binaryEncoding = isset($header['encoding']) && $header['encoding'] === self::BINARY_ENCODING_FORMAT;