Use PBKDF2 for user password hashing (2)

scripts/murmur.ini

@@ -172,6 +172,15 @@ users=100
 # system.
 #sendversion=True
 
+# This sets password hash storage to legacy mode (1.2.4 and before)
+# (Note that setting this to true is insecure and should not be used unless absolutely necessary)
+#legacyPasswordHash=false
+
+# By default a strong amount of PBKDF2 iterations are chosen automatically. If >0 this setting
+# overrides the automatic benchmark and forces a specific number of iterations.
+# (Note that you should only change this value if you know what you are doing)
+#kdfIterations=-1
+
 # You can configure any of the configuration options for Ice here. We recommend
 # leave the defaults as they are.
 # Please note that this section has to be last in the configuration file.

src/murmur/Meta.cpp

@@ -54,6 +54,8 @@ MetaParams::MetaParams() {
 	iMaxUsersPerChannel = 0;
 	iMaxTextMessageLength = 5000;
 	iMaxImageMessageLength = 131072;
+	legacyPasswordHash = false;
+	kdfIterations = -1;
 	bAllowHTML = true;
 	iDefaultChan = 0;
 	bRememberChan = true;
@@ -262,6 +264,8 @@ void MetaParams::read(QString fname) {
 	iTimeout = typeCheckedFromSettings("timeout", iTimeout);
 	iMaxTextMessageLength = typeCheckedFromSettings("textmessagelength", iMaxTextMessageLength);
 	iMaxImageMessageLength = typeCheckedFromSettings("imagemessagelength", iMaxImageMessageLength);
+	legacyPasswordHash = typeCheckedFromSettings("legacypasswordhash", legacyPasswordHash);
+	kdfIterations = typeCheckedFromSettings("kdfiterations", -1);
 	bAllowHTML = typeCheckedFromSettings("allowhtml", bAllowHTML);
 	iMaxBandwidth = typeCheckedFromSettings("bandwidth", iMaxBandwidth);
 	iDefaultChan = typeCheckedFromSettings("defaultchannel", iDefaultChan);
@@ -458,6 +462,8 @@ void MetaParams::read(QString fname) {
 	qmConfig.insert(QLatin1String("port"),QString::number(usPort));
 	qmConfig.insert(QLatin1String("timeout"),QString::number(iTimeout));
 	qmConfig.insert(QLatin1String("textmessagelength"), QString::number(iMaxTextMessageLength));
+	qmConfig.insert(QLatin1String("legacypasswordhash"), legacyPasswordHash ?  QLatin1String("true") : QLatin1String("false"));
+	qmConfig.insert(QLatin1String("kdfiterations"), QString::number(kdfIterations));
 	qmConfig.insert(QLatin1String("allowhtml"), bAllowHTML ? QLatin1String("true") : QLatin1String("false"));
 	qmConfig.insert(QLatin1String("bandwidth"),QString::number(iMaxBandwidth));
 	qmConfig.insert(QLatin1String("users"),QString::number(iMaxUsers));

src/murmur/Meta.h

@@ -63,6 +63,13 @@ class MetaParams {
 	int iMaxImageMessageLength;
 	int iOpusThreshold;
 	int iChannelNestingLimit;
+	/// If true the old SHA1 password hashing is used instead of PBKDF2
+	bool legacyPasswordHash;
+	/// Contains the default number of PBKDF2 iterations to use
+	/// when hashing passwords. If the value loaded from config
+	/// is <= 0 the value is loaded from the database and if not
+	/// available there yet found by a benchmark.
+	int kdfIterations;
 	bool bAllowHTML;
 	QString qsPassword;
 	QString qsWelcomeText;

src/murmur/PBKDF2.cpp

@@ -0,0 +1,95 @@
+/* Copyright (C) 2013, tkmorris <mauricioarozi@gmail.com>
+   Copyright (C) 2014, Stefan Hacker <dd0t@users.sourceforge.net>
+
+   All rights reserved.
+
+   Redistribution and use in source and binary forms, with or without
+   modification, are permitted provided that the following conditions
+   are met:
+
+   - Redistributions of source code must retain the above copyright notice,
+     this list of conditions and the following disclaimer.
+   - Redistributions in binary form must reproduce the above copyright notice,
+     this list of conditions and the following disclaimer in the documentation
+     and/or other materials provided with the distribution.
+   - Neither the name of the Mumble Developers nor the names of its
+     contributors may be used to endorse or promote products derived from this
+     software without specific prior written permission.
+
+   THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+   ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+   LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+   A PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR
+   CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+   EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+   PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+   PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
+   LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
+   NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+   SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+*/
+#include "murmur_pch.h"
+
+#include "PBKDF2.h"
+
+int PBKDF2::benchmark() {
+	const QString pseudopass(QLatin1String("aboutAvg"));
+	const QString hexSalt = getSalt(); // Could tolerate not getting a salt here, will likely only make it harder.
+
+	int maxIterations = -1;
+
+	QElapsedTimer timer;
+	timer.start();
+
+	for (size_t i = 0; i < BENCHMARK_N; ++i) {
+		int iterations = BENCHMARK_MINIMUM_ITERATION_COUNT / 2;
+
+		timer.restart();
+		do {
+			iterations *= 2;
+
+			// Store return value in a volatile to prevent optimizer
+			// from ever removing these side-effect-free calls. I don't
+			// think the compiler can prove they have no side-effects but
+			// better safe than sorry.
+			volatile QString result = getHash(hexSalt, pseudopass, iterations);
+			Q_UNUSED(result);
+
+		} while (timer.restart() < BENCHMARK_DURATION_TARGET_IN_MS && (iterations / 2) < std::numeric_limits<int>::max());
+
+		if (iterations > maxIterations) {
+			maxIterations = iterations;
+		}
+	}
+	return maxIterations;
+}
+
+QString PBKDF2::getHash(const QString& hexSalt, const QString& password, int iterationCount) {
+	QByteArray hash(DERIVED_KEY_LENGTH, 0);
+
+	const QByteArray utf8Password = password.toUtf8();
+	const QByteArray salt = QByteArray::fromHex(hexSalt.toLatin1());
+
+	if (PKCS5_PBKDF2_HMAC(utf8Password.constData(), utf8Password.size(),
+	                      reinterpret_cast<const unsigned char*>(salt.constData()), salt.size(),
+	                      iterationCount,
+	                      EVP_sha384(),
+	                      DERIVED_KEY_LENGTH, reinterpret_cast<unsigned char*>(hash.data())) == 0) {
+		qFatal("PBKDF2: PKCS5_PBKDF2_HMAC failed: %s", ERR_error_string(ERR_get_error(), NULL));
+		return QString();
+	}
+
+	return hash.toHex();
+}
+
+
+QString PBKDF2::getSalt() {
+	QByteArray salt(SALT_LENGTH, 0);
+
+	if (RAND_bytes(reinterpret_cast<unsigned char*>(salt.data()), salt.size()) == 0) {
+		qFatal("PBKDF2: RAND_bytes for salt failed: %s", ERR_error_string(ERR_get_error(), NULL));
+		return QString();
+	}
+
+	return salt.toHex();
+}

src/murmur/PBKDF2.h

@@ -0,0 +1,85 @@
+/* Copyright (C) 2013, tkmorris <mauricioarozi@gmail.com>
+   Copyright (C) 2014, Stefan Hacker <dd0t@users.sourceforge.net>
+
+   All rights reserved.
+
+   Redistribution and use in source and binary forms, with or without
+   modification, are permitted provided that the following conditions
+   are met:
+
+   - Redistributions of source code must retain the above copyright notice,
+     this list of conditions and the following disclaimer.
+   - Redistributions in binary form must reproduce the above copyright notice,
+     this list of conditions and the following disclaimer in the documentation
+     and/or other materials provided with the distribution.
+   - Neither the name of the Mumble Developers nor the names of its
+     contributors may be used to endorse or promote products derived from this
+     software without specific prior written permission.
+
+   THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+   ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+   LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+   A PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR
+   CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+   EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+   PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+   PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
+   LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
+   NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+   SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+*/
+#ifndef MUMBLE_MURMUR_PBKDF2_H_
+#define MUMBLE_MURMUR_PBKDF2_H_
+
+#include <stddef.h>
+
+class QString;
+
+///
+/// Fully static wrapper class for PBKF2 password hashing functionality used in Murmur.
+/// 
+/// @note Using int all over the place because OpenSSL uses them in its C interface
+///       and we want to make sure not to parameterize it in unexpected ways.
+/// @warning Operations in this class that experience internal failure will abort
+///          program execution using qFatal.
+///
+class PBKDF2 {
+	public:
+		///
+		/// @return Upper bound on iterations possible in
+		///         BENCHMARK_DURATION_TARGET_IN_MS on this machine.
+		///
+		static int benchmark();
+
+		/// Performs a PBKDF2 hash operation using EVP_sha384.
+		/// 
+		/// @param hexSalt Hex encoded salt to use in operation.
+		/// @param password Password to hash.
+		/// @param iterationCount Number of PBKDF2 iterations to apply.
+		/// @return Hex encoded password hash of DERIVED_KEY_LENGTH octets.
+		///
+		static QString getHash(const QString& hexSalt,
+		                       const QString& password,
+		                       int iterationCount);
+
+		///
+		/// @return SALT_LENGTH octets of hex encoded random salt.
+		///
+		static QString getSalt();
+
+		/// Length of hash in octets
+		static const int DERIVED_KEY_LENGTH = 48;
+		/// Length salt in octests
+		static const int SALT_LENGTH = 8;
+
+		/// Duration for hash operation the benchmark function should target
+		static const int BENCHMARK_DURATION_TARGET_IN_MS = 10;
+		/// Benchmark returns highest iteration number of N benchmark attemps
+		static const size_t BENCHMARK_N = 40;
+		/// Lower bound of iteration count returned by benchmark
+		/// regardless of duration (should be divisible by 2)
+		static const int BENCHMARK_MINIMUM_ITERATION_COUNT = 1000;
+
+};
+
+#endif // MUMBLE_MURMUR_PBKDF2_H_