SCRAM-SHA-256 support #257
Conversation
| def decode(bytes: ByteVector): Option[ServerFirst] = | ||
| utf8.decodeValue(bytes.bits).toOption.flatMap { | ||
| case Pattern(r, s, i) => | ||
| Some(ServerFirst(r, ByteVector.fromBase64(s).get, i.toInt)) |
| private val Pattern = """v=([A-Za-z0-9+/]+={0,2})""".r | ||
| def decode(bytes: ByteVector): Option[ServerFinal] = | ||
| utf8.decodeValue(bytes.bits).toOption.flatMap { | ||
| case Pattern(v) => |
There was a problem hiding this comment.
same. i know, the tiniest of nits but seeing get even when its impossible to fail ... -)
| ByteVector.view(arr).toBase64 | ||
| } | ||
| clientFirstBareWithNonce(nonce) | ||
| } |
There was a problem hiding this comment.
i suppose for this kind of thing purity isn’t the point but this i assume isn’t pure with the secure random call - would we want to wrap in an effect?
There was a problem hiding this comment.
I don't know - I originally had this in a F[_]: Sync but that percolates up the call stack. Adding a Random effect seemed overkill. So I simplified to this version.
| @@ -81,6 +81,7 @@ lazy val core = project | |||
| "org.scodec" %% "scodec-cats" % "1.0.0", | |||
| "com.beachape" %% "enumeratum" % "1.6.1", | |||
| "org.tpolecat" %% "natchez-core" % "0.0.12", | |||
| "com.ongres.stringprep" % "saslprep" % "1.1" | |||
There was a problem hiding this comment.
This is BSD 2-clause licensed and seems safe / unlikely to change or cause dependency issues for folks downstream. The main algorithm is here, which is 100+ lines of unicode manipulation: https://gitlab.com/ongresinc/stringprep/-/blob/development/saslprep/src/main/java/com/ongres/saslprep/SaslPrep.java
Codecov Report
@@ Coverage Diff @@
## master #257 +/- ##
==========================================
+ Coverage 83.88% 84.77% +0.88%
==========================================
Files 108 111 +3
Lines 1260 1327 +67
Branches 27 27
==========================================
+ Hits 1057 1125 +68
+ Misses 203 202 -1
Continue to review full report at Codecov.
|
| @@ -81,6 +81,7 @@ lazy val core = project | |||
| "org.scodec" %% "scodec-cats" % "1.0.0", | |||
| "com.beachape" %% "enumeratum" % "1.6.1", | |||
| "org.tpolecat" %% "natchez-core" % "0.0.12", | |||
| "com.ongres.stringprep" % "saslprep" % "1.1" | |||
|
|
||
| private def Hi(str: String, salt: ByteVector, iterations: Int): ByteVector = { | ||
| val spec = new javax.crypto.spec.PBEKeySpec(str.toCharArray, salt.toArray, iterations, 8 * 32) | ||
| val salted = javax.crypto.SecretKeyFactory.getInstance("PBKDF2WithHmacSHA256").generateSecret(spec).getEncoded |
There was a problem hiding this comment.
Shit almighty man, JCA gives me the heebiejeebies.
|
tagged v0.0.20 |
resolves #255