glm94/secure-core
1
0
Fork 0
Code Issues 9 Pull Requests Releases Wiki Activity

Changed the settings getting functions to accept a fll key path instead of only a Section / Key pair. Changed the placement of the pepper in the password hashing function to be in complicance with the OWASP's recommendation for using a pwpper.

Browse Source
This commit is contained in:
glm94
2021-03-29 19:15:15 -05:00
parent 9b283b31f4
commit f5ee2f68b9
5 changed files with 25 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
SecureCore/Authentication/PasswordManager.cs
+5 -5
View File
@@ -26,7 +26,7 @@ namespace SecureCore.Authentication
{
if (!string.IsNullOrEmpty(Pepper)) throw new InvalidOperationException("The PasswordManager's settings have already been initialized. Operation aborted.");
if (AppSettingsManager.TryGetSettingInt(SectionName, "MaxLength", out int maxPasswordLength))
if (AppSettingsManager.TryGetSettingInt($"{SectionName}.MaxLength", out int maxPasswordLength))
{
//As noted in this article https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html#maximum-password-lengths
//allowing passwords that are too long can result in a denial-of-service attack. So we must enforce an upper bound
@@ -36,7 +36,7 @@ namespace SecureCore.Authentication
}
else maxPasswordLength = AbsoluteMaxPasswordLength;
if (AppSettingsManager.TryGetSettingInt(SectionName, "MinLength", out int minPasswordLength))
if (AppSettingsManager.TryGetSettingInt($"{SectionName}.MinLength", out int minPasswordLength))
{
//There was no mention of a min password length in the above article, so I've chosen on a whim that 16 should
//be a safe enough min on a password's length. So as usual, just ignore settings that are out of bounds and
@@ -54,7 +54,7 @@ namespace SecureCore.Authentication
MinPasswordLength = minPasswordLength;
MaxPasswordLength = maxPasswordLength;
//Now read in the pepper. A pepper being a string of characters at least 32 characters long that is NOT stored in the database and is used in conjunction with hashing sensitive user data.
if (AppSettingsManager.TryGetSettingString(SectionName, "Pepper", out string pepper))
if (AppSettingsManager.TryGetSettingString($"{SectionName}.Pepper", out string pepper))
{
//As noted here https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html a pepper should be at least 32 bytes in size.
if (pepper.Length < AbsoluteMinPepperLength) throw new Exception("A pepper must be at least 32 characters long for security reasons.");
@@ -64,7 +64,7 @@ namespace SecureCore.Authentication
Pepper = pepper;
//Finally, the work factor (A.K.A. iterations) for the hashing algorithm.
if (AppSettingsManager.TryGetSettingInt(SectionName, "Iterations", out int iterations))
if (AppSettingsManager.TryGetSettingInt($"{SectionName}.Iterations", out int iterations))
{
//The work factor must be of a certain strength and if it fails this check then we will be forced to ignore it and use the recommended work factor
//as stated here: https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html#pbkdf2
@@ -171,7 +171,7 @@ namespace SecureCore.Authentication
private static string GetHash(string password, byte[] salt)
{
return Convert.ToBase64String(KeyDerivation.Pbkdf2($"{password}{Pepper}", salt, KeyType, Iterations, KeySize));
return Convert.ToBase64String(KeyDerivation.Pbkdf2($"{Pepper}{password}", salt, KeyType, Iterations, KeySize));
}
}
}