GothenburgBitFactory/taskwarrior
1
0
Fork 0
mirror of https://github.com/GothenburgBitFactory/taskwarrior.git synced 2025-08-20 04:13:07 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 6

sync: Use 600,000 iterations for pbkdf2. (#3251)

Browse source 
Per [wikipedia](https://en.wikipedia.org/wiki/PBKDF2), "In 2023, OWASP
recommended to use 600,000 iterations for PBKDF2-HMAC-SHA256..."
This commit is contained in:
ryneeverett 2024-01-21 14:06:53 -05:00 • committed by GitHub
parent 323bd23251
commit 4008069a70
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
9 changed files with 11 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

2
taskchampion/docs/src/encryption.md
View file

@ -7,7 +7,7 @@ Encryption is not used for local (on-disk) sync, but is used for all cases where
## Key Derivation ## Key Derivation
The client derives the 32-byte encryption key from the configured encryption secret using PBKDF2 with HMAC-SHA256 and 100,000 iterations. The client derives the 32-byte encryption key from the configured encryption secret using PBKDF2 with HMAC-SHA256 and 600,000 iterations.
The salt value depends on the implementation of the protocol, as described in subsequent chapters. The salt value depends on the implementation of the protocol, as described in subsequent chapters.
## Encryption ## Encryption

2
taskchampion/taskchampion/src/server/encryption.rs
View file

@ -4,7 +4,7 @@ use crate::errors::{Error, Result};
use ring::{aead, pbkdf2, rand, rand::SecureRandom}; use ring::{aead, pbkdf2, rand, rand::SecureRandom};
use uuid::Uuid; use uuid::Uuid;
const PBKDF2_ITERATIONS: u32 = 100000; const PBKDF2_ITERATIONS: u32 = 600000;
const ENVELOPE_VERSION: u8 = 1; const ENVELOPE_VERSION: u8 = 1;
const AAD_LEN: usize = 17; const AAD_LEN: usize = 17;
const TASK_APP_ID: u8 = 1; const TASK_APP_ID: u8 = 1;

2
taskchampion/taskchampion/src/server/generate-test-data.py
View file

@ -25,7 +25,7 @@ def gen(
encryption_secret, encryption_secret,
salt, salt,
digestmodule=hashlib.sha256, digestmodule=hashlib.sha256,
iterations=100000, iterations=600000,
).read(32) ).read(32)
# create a nonce # create a nonce

3
taskchampion/taskchampion/src/server/test-bad-app-id.data
View file

@ -1,2 +1 @@
® k_Я╔uз▄x9ФmЙшg╦└┬%j╜[с5щ+╧k≤В╓╪/│
<EFBFBD>KŸo]æâʶ£‘†‘McØ\ï©QL)cHÂ;ÚÎ-:

2
taskchampion/taskchampion/src/server/test-bad-client-id.data
View file

@ -1 +1 @@
%<25>ۇ <09><07><>ko¹<6F>{hكb<D983><62><EFBFBD> <0A><><02>ˁLqU [<5B>+Æ¢BÞÞYök‹­Ch58-éJóCî¢<Ø<>š¬ô)Å›

2
taskchampion/taskchampion/src/server/test-bad-secret.data
View file

@ -1 +1 @@
κsq<0F><>nΟΐk,Βν\ ‹ΕΘ;W¶< ΄' ®Ξ;{Π<> ιΏYΖΐ#π_D<15><>υ>Ο½ά<C2BD>jή<6A>Ο3FσΖ#–<>BΔQ

3
taskchampion/taskchampion/src/server/test-bad-version-id.data
View file

@ -1 +1,2 @@
 ñ±Ÿâ–ajJ›šÕ·ïq\IF4¤ó<C2A4>Y Ó£ €$‹ë9W ﾃP*ﾄﾚｦ\嵓搖`SﾅUﾜ<55>ｷ~<7E>Wcｻ`ﾝ戛ﾆﾝ
ｵ

3
taskchampion/taskchampion/src/server/test-bad-version.data
View file

@ -1 +1,2 @@
cR<06>ùË|¯|iKoÌÀ˜³+t•U|Ñ™ï˜&  —BIŸ·3 cl<EFBFBD>;<3B>L+ѩ<><D1A9>'p<>f?
jn<0E><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>v<EFBFBD><1D>O\<5C><>

2
taskchampion/taskchampion/src/server/test-good.data
View file

@ -1 +1 @@
PRÇojÇ—Þgs²&vMØYÔn<>œ?ƒÛcå¼~:œ Êx-÷ãàLh¿Aí4?A¸°T3çQ¦Ñe‰R«VW•±