Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

ELY-2351 Fix SCRAM password generation with PKCS#11 (FIPS) #1719

Merged
merged 1 commit into from
Aug 2, 2022
Merged

ELY-2351 Fix SCRAM password generation with PKCS#11 (FIPS) #1719

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
45 changes: 40 additions & 5 deletions password/impl/src/main/java/org/wildfly/security/password/impl/ScramDigestPasswordImpl.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,6 +28,7 @@
import java.security.InvalidAlgorithmParameterException;
import java.security.InvalidKeyException;
import java.security.Key;
import java.security.MessageDigest;
import java.security.NoSuchAlgorithmException;
import java.security.spec.AlgorithmParameterSpec;
import java.security.spec.InvalidKeySpecException;
Expand Down Expand Up @@ -284,32 +285,34 @@ static void addIterations(final byte[] hi, final Mac hmac, final int currentIter
* </p>
*
* @param algorithm the algorithm that should be used to hash the password.
* @param password the password to be hashed.
* @param password the password to be hashed. It will be padded according to the HMAC block size.
* @return the constructed {@link Mac} instance.
*/
private static Mac getMacInstance(final String algorithm, final byte[] password) throws NoSuchAlgorithmException, InvalidKeyException {
byte[] padded = hmacPad(algorithm, password);
//byte[] padded = password;
switch (algorithm) {
case ALGORITHM_SCRAM_SHA_1: {
Mac hmac = Mac.getInstance(HMAC_SHA1_ALGORITHM);
Key key = new SecretKeySpec(password, HMAC_SHA1_ALGORITHM);
Key key = new SecretKeySpec(padded, HMAC_SHA1_ALGORITHM);
hmac.init(key);
return hmac;
}
case ALGORITHM_SCRAM_SHA_256: {
Mac hmac = Mac.getInstance(HMAC_SHA256_ALGORITHM);
Key key = new SecretKeySpec(password, HMAC_SHA256_ALGORITHM);
Key key = new SecretKeySpec(padded, HMAC_SHA256_ALGORITHM);
hmac.init(key);
return hmac;
}
case ALGORITHM_SCRAM_SHA_384: {
Mac hmac = Mac.getInstance(HMAC_SHA384_ALGORITHM);
Key key = new SecretKeySpec(password, HMAC_SHA384_ALGORITHM);
Key key = new SecretKeySpec(padded, HMAC_SHA384_ALGORITHM);
hmac.init(key);
return hmac;
}
case ALGORITHM_SCRAM_SHA_512: {
Mac hmac = Mac.getInstance(HMAC_SHA512_ALGORITHM);
Key key = new SecretKeySpec(password, HMAC_SHA512_ALGORITHM);
Key key = new SecretKeySpec(padded, HMAC_SHA512_ALGORITHM);
hmac.init(key);
return hmac;
}
Expand All @@ -318,6 +321,38 @@ private static Mac getMacInstance(final String algorithm, final byte[] password)
}
}

private static byte[] hmacPad(final String algorithm, byte[] password) throws NoSuchAlgorithmException {
int blockSize;
String digestAlgo;
switch (algorithm) {
case ScramDigestPassword.ALGORITHM_SCRAM_SHA_1:
blockSize = 64;
digestAlgo = "SHA-1";
break;
case ScramDigestPassword.ALGORITHM_SCRAM_SHA_256:
blockSize = 64;
digestAlgo = "SHA-256";
break;
case ScramDigestPassword.ALGORITHM_SCRAM_SHA_384:
blockSize = 128;
digestAlgo = "SHA-384";
break;
case ScramDigestPassword.ALGORITHM_SCRAM_SHA_512:
blockSize = 128;
digestAlgo = "SHA-512";
break;
default:
throw log.noSuchAlgorithmInvalidAlgorithm(algorithm);
}
byte[] bytes = new byte[blockSize];
if (password.length > blockSize) {
MessageDigest md = MessageDigest.getInstance(digestAlgo);
password = md.digest(password);
}
System.arraycopy(password, 0, bytes, 0, Math.min(password.length, blockSize));
return bytes;
}

public int hashCode() {
return multiHashOrdered(multiHashOrdered(multiHashOrdered(Arrays.hashCode(digest), Arrays.hashCode(salt)), iterationCount), algorithm.hashCode());
}
Expand Down