-
Notifications
You must be signed in to change notification settings - Fork 1.3k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
[PM-3565] Enforce higher minimum KDF (#6440)
Changes minimum iterations for PBKDF2 to 600 000. Also converts the constants into ranges to ensure there is only a single place for all checks.
- Loading branch information
Showing
10 changed files
with
150 additions
and
45 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,14 +1,15 @@ | ||
| import { KdfConfig } from "../../auth/models/domain/kdf-config"; | ||
| import { RangeWithDefault } from "../misc/range-with-default"; | ||
|
|
||
| export enum KdfType { | ||
| PBKDF2_SHA256 = 0, | ||
| Argon2id = 1, | ||
| } | ||
|
|
||
| export const DEFAULT_ARGON2_MEMORY = 64; | ||
| export const DEFAULT_ARGON2_PARALLELISM = 4; | ||
| export const DEFAULT_ARGON2_ITERATIONS = 3; | ||
| export const ARGON2_MEMORY = new RangeWithDefault(16, 1024, 64); | ||
| export const ARGON2_PARALLELISM = new RangeWithDefault(1, 16, 4); | ||
| export const ARGON2_ITERATIONS = new RangeWithDefault(2, 10, 3); | ||
|
|
||
| export const DEFAULT_KDF_TYPE = KdfType.PBKDF2_SHA256; | ||
| export const DEFAULT_PBKDF2_ITERATIONS = 600000; | ||
| export const DEFAULT_KDF_CONFIG = new KdfConfig(DEFAULT_PBKDF2_ITERATIONS); | ||
| export const PBKDF2_ITERATIONS = new RangeWithDefault(600_000, 2_000_000, 600_000); | ||
| export const DEFAULT_KDF_CONFIG = new KdfConfig(PBKDF2_ITERATIONS.defaultValue); |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,26 @@ | ||
| import { RangeWithDefault } from "./range-with-default"; | ||
|
|
||
| describe("RangeWithDefault", () => { | ||
| describe("constructor", () => { | ||
| it("should throw an error when min is greater than max", () => { | ||
| expect(() => new RangeWithDefault(10, 5, 0)).toThrowError("10 is greater than 5."); | ||
| }); | ||
|
|
||
| it("should throw an error when default value is not in range", () => { | ||
| expect(() => new RangeWithDefault(0, 10, 20)).toThrowError("Default value is not in range."); | ||
| }); | ||
| }); | ||
|
|
||
| describe("inRange", () => { | ||
| it("should return true when in range", () => { | ||
| const range = new RangeWithDefault(0, 10, 5); | ||
| expect(range.inRange(5)).toBe(true); | ||
| }); | ||
|
|
||
| it("should return false when not in range", () => { | ||
| const range = new RangeWithDefault(5, 10, 7); | ||
| expect(range.inRange(1)).toBe(false); | ||
| expect(range.inRange(20)).toBe(false); | ||
| }); | ||
| }); | ||
| }); |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,24 @@ | ||
| /** | ||
| * A range with a default value. | ||
| * | ||
| * Enforces constraints to ensure min > default > max. | ||
| */ | ||
| export class RangeWithDefault { | ||
| constructor( | ||
| readonly min: number, | ||
| readonly max: number, | ||
| readonly defaultValue: number, | ||
| ) { | ||
| if (min > max) { | ||
| throw new Error(`${min} is greater than ${max}.`); | ||
| } | ||
|
|
||
| if (this.inRange(defaultValue) === false) { | ||
| throw new Error("Default value is not in range."); | ||
| } | ||
| } | ||
|
|
||
| inRange(value: number): boolean { | ||
| return value >= this.min && value <= this.max; | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters