Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Bug in Verify code when rounds is specified #9

Open
ulziibay opened this issue Oct 5, 2021 · 1 comment
Open

Bug in Verify code when rounds is specified #9

ulziibay opened this issue Oct 5, 2021 · 1 comment

Comments

@ulziibay
Copy link

ulziibay commented Oct 5, 2021

When using https://pkg.go.dev/bytes#SplitN as part of the Decode step for Verify call, the $<id>[$<param>=<value>(,<param>=<value>)*][$<salt>[$<hash>]] formatted string is not properly split, leading into incorrect results for Verify
See: https://play.golang.org/p/Pk8URcLJxmx

For a hash string like this, the results in a tokens array that has incorrectly combined the hash with the salt. $6$rounds=10000$mysalt$9XTP7570fxVN/uTspSrH6kRPdR4KKGzGz7.TmJjDYGrKSwZuavW/3YaLur8JX6WP75Czcxa.megIO0lKreY0R.
Thus, call at https://github.com/GehirnInc/crypt/blob/master/common/salt.go#L125 incorrectly parses the salt, leading to error in the Verification.

@ulziibay ulziibay changed the title Bug in Verify code Bug in Verify code when rounds is specified Oct 5, 2021
@drakkan
Copy link
Contributor

drakkan commented Mar 17, 2023

It works for me, see here.

func TestVerifyWithRounds(t *testing.T) {
	data := []struct {
		key  []byte
		hash string
	}{
		{
			[]byte("Hello world!"),
			"$6$rounds=10000$saltstringsaltst$OW1/O6BYHV6BcXZu8QVeXbDWra3Oeqh" +
				"0sbHbbMCVNSnCM/UrjmM0Dp8vOuZeHBy/YTBmSK6H9qs/y3RnOaw5v.",
		},
		{
			[]byte("Hello world!"),
			"$6$saltstring$svn8UoSVapNtMuq1ukKS4tPQd8iKwSMHWjl/O817G3uBnIFNjn" +
				"QJuesI68u4OTLiBFdcbYEdFCoEOfaS35inz1",
		},
	}
	for i, d := range data {
		if err := sha512Crypt.Verify(d.hash, d.key); err != nil {
			t.Errorf("Test %d failed: %s", i, d)
		}
	}
}

Please provide a valid hashed string (and its plaintext equivalent) that doesn't work for you

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants