summaryrefslogtreecommitdiff
path: root/filters/gentoo-ldap-authentication.lua
diff options
context:
space:
mode:
authorJason A. Donenfeld <Jason@zx2c4.com>2018-07-14 01:32:00 +0000
committerJason A. Donenfeld <Jason@zx2c4.com>2018-07-14 01:33:56 +0000
commitc3b5b5f648d953307672a4b30e9222787668f708 (patch)
tree6b2179805885fe812fddc8d54d8e8fd5ee4f6292 /filters/gentoo-ldap-authentication.lua
parentc132ef2462b3c5223c77eb68fa372edde85cfb6b (diff)
downloadcgit-c3b5b5f648d953307672a4b30e9222787668f708.tar
cgit-c3b5b5f648d953307672a4b30e9222787668f708.tar.gz
cgit-c3b5b5f648d953307672a4b30e9222787668f708.zip
auth-filters: do not use HMAC-SHA1
Though SHA1 is broken, HMAC-SHA1 is still fine. But let's not push our luck; SHA256 is more sensible anyway. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Diffstat (limited to 'filters/gentoo-ldap-authentication.lua')
-rw-r--r--filters/gentoo-ldap-authentication.lua4
1 files changed, 2 insertions, 2 deletions
diff --git a/filters/gentoo-ldap-authentication.lua b/filters/gentoo-ldap-authentication.lua
index 6d8eb3e..c1e382f 100644
--- a/filters/gentoo-ldap-authentication.lua
+++ b/filters/gentoo-ldap-authentication.lua
@@ -271,7 +271,7 @@ function validate_value(expected_field, cookie)
end
-- Lua hashes strings, so these comparisons are time invariant.
- if hmac ~= crypto.hmac.digest("sha1", field .. "|" .. value .. "|" .. tostring(expiration) .. "|" .. salt, secret) then
+ if hmac ~= crypto.hmac.digest("sha256", field .. "|" .. value .. "|" .. tostring(expiration) .. "|" .. salt, secret) then
return nil
end
@@ -296,7 +296,7 @@ function secure_value(field, value, expiration)
value = url_encode(value)
field = url_encode(field)
authstr = field .. "|" .. value .. "|" .. tostring(expiration) .. "|" .. salt
- authstr = authstr .. "|" .. crypto.hmac.digest("sha1", authstr, secret)
+ authstr = authstr .. "|" .. crypto.hmac.digest("sha256", authstr, secret)
return authstr
end