use sha256 as default hasher of PBKDF2

use sha256 with iterations of 250000 as default hasher of PBKDF2 to prevent weak security problem related to CVE-2023-46233 of crypto-js
originjs · Jun 25, 2024 · 7d4341d · 7d4341d
1 parent 596159e
commit 7d4341d
Show file tree

Hide file tree

Showing 3 changed files with 23 additions and 23 deletions.
diff --git a/src/algo/pbkdf2/pbkdf2.js b/src/algo/pbkdf2/pbkdf2.js
@@ -2,7 +2,7 @@ import {
   Base,
   WordArray
 } from '../../core/core.js';
-import { SHA1Algo } from '../hash/sha1.js';
+import { SHA256Algo } from '../hash/sha256.js';
 import { HMAC } from '../hmac/hmac.js';
 
 
@@ -28,28 +28,28 @@ export class PBKDF2Algo extends Base {
      * Configuration options.
      *
      * @property {number} keySize The key size in words to generate. Default: 4 (128 bits)
-     * @property {Hasher} hasher The hasher to use. Default: SHA1
-     * @property {number} iterations The number of iterations to perform. Default: 1
+     * @property {Hasher} hasher The hasher to use. Default: SHA256
+     * @property {number} iterations The number of iterations to perform. Default: 250000
      */
     this.cfg = Object.assign(
       new Base(),
       {
         keySize: 128 / 32,
-        hasher: SHA1Algo,
-        iterations: 1
+        hasher: SHA256Algo,
+        iterations: 250000
       },
       cfg
     );
   }
 
   /**
-   * SHA1 is the default hasher of pbkdf2.
+   * SHA256 is the default hasher of pbkdf2.
    * With another hasher configured, user should call the corresponding loadWasm of the configured hasher.
    *
    * @returns {Promise<null>}
    */
   static async loadWasm() {
-    return SHA1Algo.loadWasm();
+    return SHA256Algo.loadWasm();
   }
 
   async loadWasm() {

diff --git a/test/algo.pbkdf2.profile.test.js b/test/algo.pbkdf2.profile.test.js
@@ -1,7 +1,7 @@
 import C from '../src/index';
 
 beforeAll(async () => {
-  await C.SHA1.loadWasm();
+  await C.SHA256.loadWasm();
 });
 
 describe('algo-pbkdf2-profile', () => {

diff --git a/test/algo.pbkdf2.test.js b/test/algo.pbkdf2.test.js
@@ -1,104 +1,104 @@
 import C from '../src/index';
 
 beforeAll(async () => {
-  await C.SHA1.loadWasm();
+  await C.SHA256.loadWasm();
 });
 
 describe('algo-pbkdf2-test', () => {
   test('testKeySize128', () => {
     expect(C.PBKDF2('password', 'ATHENA.MIT.EDUraeburn', {
       keySize: 128 / 32
-    }).toString()).toBe('cdedb5281bb2f801565a1122b2563515');
+    }).toString()).toBe('62929ab995a1111c75c37bc562261ea3');
   });
 
   test('testKeySize256', () => {
     expect(C.PBKDF2('password', 'ATHENA.MIT.EDUraeburn', {
       keySize: 256 / 32
-    }).toString()).toBe('cdedb5281bb2f801565a1122b25635150ad1f7a04bb9f3a333ecc0e2e1f70837');
+    }).toString()).toBe('62929ab995a1111c75c37bc562261ea3fb3cdc7e725c4ca87c03cec5bb7663e1');
   });
 
   test('testKeySize128Iterations2', () => {
     expect(C.PBKDF2('password', 'ATHENA.MIT.EDUraeburn', {
       keySize: 128 / 32,
       iterations: 2
-    }).toString()).toBe('01dbee7f4a9e243e988b62c73cda935d');
+    }).toString()).toBe('262fb72ea65b44ab5ceba7f8c8bfa781');
   });
 
   test('testKeySize256Iterations2', () => {
     expect(C.PBKDF2('password', 'ATHENA.MIT.EDUraeburn', {
       keySize: 256 / 32,
       iterations: 2
-    }).toString()).toBe('01dbee7f4a9e243e988b62c73cda935da05378b93244ec8f48a99e61ad799d86');
+    }).toString()).toBe('262fb72ea65b44ab5ceba7f8c8bfa7815ff9939204eb7357a59a75877d745777');
   });
 
   test('testKeySize128Iterations1200', () => {
     expect(C.PBKDF2('password', 'ATHENA.MIT.EDUraeburn', {
       keySize: 128 / 32,
       iterations: 1200
-    }).toString()).toBe('5c08eb61fdf71e4e4ec3cf6ba1f5512b');
+    }).toString()).toBe('c76a982415f1acc71dc197273c5b6ada');
   });
 
   test('testKeySize256Iterations1200', () => {
     expect(C.PBKDF2('password', 'ATHENA.MIT.EDUraeburn', {
       keySize: 256 / 32,
       iterations: 1200
-    }).toString()).toBe('5c08eb61fdf71e4e4ec3cf6ba1f5512ba7e52ddbc5e5142f708a31e2e62b1e13');
+    }).toString()).toBe('c76a982415f1acc71dc197273c5b6ada32f62915ed461718aad32843762433fa');
   });
 
   test('testKeySize128Iterations5', () => {
     expect(C.PBKDF2('password', C.enc.Hex.parse('1234567878563412'), {
       keySize: 128 / 32,
       iterations: 5
-    }).toString()).toBe('d1daa78615f287e6a1c8b120d7062a49');
+    }).toString()).toBe('74e98b2e9eeddaab3113c1efc6d82b07');
   });
 
   test('testKeySize256Iterations5', () => {
     expect(C.PBKDF2('password', C.enc.Hex.parse('1234567878563412'), {
       keySize: 256 / 32,
       iterations: 5
-    }).toString()).toBe('d1daa78615f287e6a1c8b120d7062a493f98d203e6be49a6adf4fa574b6e64ee');
+    }).toString()).toBe('74e98b2e9eeddaab3113c1efc6d82b073c4860195b3e0737fa21a4778f376321');
   });
 
   test('testKeySize128Iterations1200PassPhraseEqualsBlockSize', () => {
     expect(C.PBKDF2('XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX', 'pass phrase equals block size', {
       keySize: 128 / 32,
       iterations: 1200
-    }).toString()).toBe('139c30c0966bc32ba55fdbf212530ac9');
+    }).toString()).toBe('c1dfb29a4d2f2fb67c6f78d074d66367');
   });
 
   test('testKeySize256Iterations1200PassPhraseEqualsBlockSize', () => {
     expect(C.PBKDF2('XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX', 'pass phrase equals block size', {
       keySize: 256 / 32,
       iterations: 1200
-    }).toString()).toBe('139c30c0966bc32ba55fdbf212530ac9c5ec59f1a452f5cc9ad940fea0598ed1');
+    }).toString()).toBe('c1dfb29a4d2f2fb67c6f78d074d663671e6fd4da1e598572b1fecf256cb7cf61');
   });
 
   test('testKeySize128Iterations1200PassPhraseExceedsBlockSize', () => {
     expect(C.PBKDF2('XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX', 'pass phrase exceeds block size', {
       keySize: 128 / 32,
       iterations: 1200
-    }).toString()).toBe('9ccad6d468770cd51b10e6a68721be61');
+    }).toString()).toBe('22344bc4b6e32675a8090f3ea80be01d');
   });
 
   test('testKeySize256Iterations1200PassPhraseExceedsBlockSize', () => {
     expect(C.PBKDF2('XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX', 'pass phrase exceeds block size', {
       keySize: 256 / 32,
       iterations: 1200
-    }).toString()).toBe('9ccad6d468770cd51b10e6a68721be611a8b4d282601db3b36be9246915ec82a');
+    }).toString()).toBe('22344bc4b6e32675a8090f3ea80be01d5f95126a2cddc3facc4a5e6dca04ec58');
   });
 
   test('testKeySize128Iterations50', () => {
     expect(C.PBKDF2(C.enc.Hex.parse('f09d849e'), 'EXAMPLE.COMpianist', {
       keySize: 128 / 32,
       iterations: 50
-    }).toString()).toBe('6b9cf26d45455a43a5b8bb276a403b39');
+    }).toString()).toBe('44b0781253db3141ac4174af29325818');
   });
 
   test('testKeySize256Iterations50', () => {
     expect(C.PBKDF2(C.enc.Hex.parse('f09d849e'), 'EXAMPLE.COMpianist', {
       keySize: 256 / 32,
       iterations: 50
-    }).toString()).toBe('6b9cf26d45455a43a5b8bb276a403b39e7fe37a0c41e02c281ff3069e1e94f52');
+    }).toString()).toBe('44b0781253db3141ac4174af29325818584698d507a79f9879033dec308a2b77');
   });
 
   test('testInputIntegrity', () => {