From a33089083eb6c9c5fc8b8dc0cda064c39ccd3529 Mon Sep 17 00:00:00 2001 From: Tobias Klika Date: Tue, 9 Nov 2021 12:22:39 +0100 Subject: [PATCH] remove obsolete RNGCryptoServiceProvider from token provider --- zero.Core/Tokens/ZeroTokenProvider.cs | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-) diff --git a/zero.Core/Tokens/ZeroTokenProvider.cs b/zero.Core/Tokens/ZeroTokenProvider.cs index 8ec737ad..b7e33b73 100644 --- a/zero.Core/Tokens/ZeroTokenProvider.cs +++ b/zero.Core/Tokens/ZeroTokenProvider.cs @@ -117,8 +117,7 @@ namespace zero.Core.Tokens public string Random(int length) { byte[] data = new byte[4 * length]; - using RNGCryptoServiceProvider crypto = new(); - crypto.GetBytes(data); + randonNumberGenerator.GetBytes(data); StringBuilder result = new(length); @@ -155,7 +154,7 @@ namespace zero.Core.Tokens key = key.ToLowerInvariant(); KeyDerivationPrf prf = KeyDerivationPrf.HMACSHA256; - int iterationCount = 100; + int iterationCount = 10000; int saltSize = 128 / 8; int numBytesRequested = 256 / 8; @@ -182,12 +181,11 @@ namespace zero.Core.Tokens bool VerifyKey(string storedKey, string key) { byte[] decodedStoredKey = Convert.FromBase64String(storedKey); - int embeddedIterCount = default(int); try { KeyDerivationPrf prf = (KeyDerivationPrf)ReadNetworkByteOrder(decodedStoredKey, 1); - embeddedIterCount = (int)ReadNetworkByteOrder(decodedStoredKey, 5); + int embeddedIterCount = (int)ReadNetworkByteOrder(decodedStoredKey, 5); int saltLength = (int)ReadNetworkByteOrder(decodedStoredKey, 9); // Read the salt: must be >= 128 bits @@ -208,10 +206,10 @@ namespace zero.Core.Tokens byte[] expectedSubkey = new byte[subkeyLength]; Buffer.BlockCopy(decodedStoredKey, 13 + salt.Length, expectedSubkey, 0, expectedSubkey.Length); - // Hash the incoming password and verify it + // Hash the incoming key and verify it byte[] actualSubkey = KeyDerivation.Pbkdf2(key, salt, prf, embeddedIterCount, subkeyLength); - return true; + return CryptographicOperations.FixedTimeEquals(actualSubkey, expectedSubkey); } catch { @@ -230,7 +228,10 @@ namespace zero.Core.Tokens static uint ReadNetworkByteOrder(byte[] buffer, int offset) { - return ((uint)(buffer[offset + 0]) << 24) | ((uint)(buffer[offset + 1]) << 16) | ((uint)(buffer[offset + 2]) << 8) | ((uint)(buffer[offset + 3])); + return ((uint)(buffer[offset + 0]) << 24) + | ((uint)(buffer[offset + 1]) << 16) + | ((uint)(buffer[offset + 2]) << 8) + | ((uint)(buffer[offset + 3])); } }