Browse Source

implement server-side scrypt to protect passwords better

master
Peter Cai 3 years ago
parent
commit
b10a50be08
No known key found for this signature in database
GPG Key ID: 71F5FB4E4F3FD54F
  1. 141
      Cargo.lock
  2. 1
      Cargo.toml
  3. 1
      src/main.rs
  4. 81
      src/user.rs

141
Cargo.lock generated

@ -51,6 +51,33 @@ version = "1.2.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "cf1de2fe8c75bc145a2f577add951f8134889b4795d47466a54a5c846d691693"
[[package]]
name = "block-buffer"
version = "0.7.3"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "c0940dc441f31689269e10ac70eb1002a3a1d3ad1390e030043662eb7fe4688b"
dependencies = [
"block-padding",
"byte-tools",
"byteorder",
"generic-array",
]
[[package]]
name = "block-padding"
version = "0.1.5"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "fa79dedbb091f449f1f39e53edf88d5dbe95f895dae6135a8d7b881fb5af73f5"
dependencies = [
"byte-tools",
]
[[package]]
name = "byte-tools"
version = "0.3.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "e3b5ca7a04898ad4bcd41c90c5285445ff5b791899bb1b0abdd2a2aa791211d7"
[[package]]
name = "byteorder"
version = "1.3.4"
@ -90,6 +117,16 @@ dependencies = [
"url",
]
[[package]]
name = "crypto-mac"
version = "0.7.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "4434400df11d95d556bac068ddfedd482915eb18fe8bea89bc80b6e4b1c179e5"
dependencies = [
"generic-array",
"subtle",
]
[[package]]
name = "devise"
version = "0.2.0"
@ -155,6 +192,15 @@ dependencies = [
"migrations_macros",
]
[[package]]
name = "digest"
version = "0.8.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "f3d0c8c8752312f9713efd397ff63acb9f85585afbf179282e720e7704954dd5"
dependencies = [
"generic-array",
]
[[package]]
name = "dotenv"
version = "0.9.0"
@ -164,6 +210,12 @@ dependencies = [
"regex",
]
[[package]]
name = "fake-simd"
version = "0.1.2"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "e88a8acf291dafb59c2d96e8f59828f3838bb1a70398823ade51a84de6a6deed"
[[package]]
name = "filetime"
version = "0.2.8"
@ -223,6 +275,15 @@ version = "0.3.55"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "8f5f3913fa0bfe7ee1fd8248b6b9f42a5af4b9d65ec2dd2c3c26132b950ecfc2"
[[package]]
name = "generic-array"
version = "0.12.3"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "c68f0274ae0e023facc3c97b2e00f076be70e254bc851d972503b328db79b2ec"
dependencies = [
"typenum",
]
[[package]]
name = "hermit-abi"
version = "0.1.7"
@ -232,6 +293,16 @@ dependencies = [
"libc",
]
[[package]]
name = "hmac"
version = "0.7.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "5dcb5e64cda4c23119ab41ba960d1e170a774c8e4b9d9e6a9bc18aabf5e59695"
dependencies = [
"crypto-mac",
"digest",
]
[[package]]
name = "httparse"
version = "1.3.4"
@ -523,6 +594,12 @@ dependencies = [
"libc",
]
[[package]]
name = "opaque-debug"
version = "0.2.3"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "2839e79665f131bdb5782e51f2c6c9599c133c6098982a54c794358bf432529c"
[[package]]
name = "parking_lot"
version = "0.10.0"
@ -547,6 +624,16 @@ dependencies = [
"winapi 0.3.8",
]
[[package]]
name = "pbkdf2"
version = "0.3.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "006c038a43a45995a9670da19e67600114740e8511d4333bf97a56e66a7542d9"
dependencies = [
"byteorder",
"crypto-mac",
]
[[package]]
name = "pear"
version = "0.1.2"
@ -651,6 +738,19 @@ dependencies = [
"winapi 0.3.8",
]
[[package]]
name = "rand"
version = "0.5.6"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "c618c47cd3ebd209790115ab837de41425723956ad3ce2e6a7f09890947cacb9"
dependencies = [
"cloudabi",
"fuchsia-cprng",
"libc",
"rand_core 0.3.1",
"winapi 0.3.8",
]
[[package]]
name = "rand_core"
version = "0.3.1"
@ -850,6 +950,22 @@ version = "1.1.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "d29ab0c6d3fc0ee92fe66e2d99f700eab17a8d57d1c1d3b748380fb20baa78cd"
[[package]]
name = "scrypt"
version = "0.2.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "656c79d0e90d0ab28ac86bf3c3d10bfbbac91450d3f190113b4e76d9fec3cfdd"
dependencies = [
"base64 0.9.3",
"byte-tools",
"byteorder",
"hmac",
"pbkdf2",
"rand 0.5.6",
"sha2",
"subtle",
]
[[package]]
name = "serde"
version = "1.0.104"
@ -892,9 +1008,22 @@ dependencies = [
"rocket",
"rocket_contrib",
"rust-crypto",
"scrypt",
"serde",
]
[[package]]
name = "sha2"
version = "0.8.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "27044adfd2e1f077f649f59deb9490d3941d674002f7d062870a60ebe9bd47a0"
dependencies = [
"block-buffer",
"digest",
"fake-simd",
"opaque-debug",
]
[[package]]
name = "slab"
version = "0.4.2"
@ -922,6 +1051,12 @@ version = "0.4.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "7345c971d1ef21ffdbd103a75990a15eb03604fc8b8852ca8cb418ee1a099028"
[[package]]
name = "subtle"
version = "1.0.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "2d67a5a62ba6e01cb2192ff309324cb4875d0c451d55fe2319433abe7a05a8ee"
[[package]]
name = "syn"
version = "0.15.44"
@ -985,6 +1120,12 @@ version = "0.1.2"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "1410f6f91f21d1612654e7cc69193b0334f909dcf2c790c4826254fbb86f8887"
[[package]]
name = "typenum"
version = "1.11.2"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "6d2783fe2d6b8c1101136184eb41be8b1ad379e4657050b8aaff0c79ee7575f9"
[[package]]
name = "ucd-util"
version = "0.1.7"

1
Cargo.toml

@ -12,4 +12,5 @@ diesel = { version = "1.4.3", features = ["sqlite"] }
diesel_migrations = "1.4.0"
dotenv = "0.9.0"
serde = { version = "1.0.104", features = ["derive"] }
scrypt = "0.2.0"
rust-crypto = "0.2.36"

1
src/main.rs

@ -12,6 +12,7 @@ extern crate dotenv;
#[macro_use]
extern crate serde;
extern crate crypto;
extern crate scrypt;
mod schema;
mod api;

81
src/user.rs

@ -15,8 +15,40 @@ impl UserOpError {
}
}
#[derive(Queryable, Debug)]
pub struct User {
// Password should ALWAYS be hashed
#[derive(Debug)]
pub struct Password(String);
impl Password {
fn new(passwd: &str) -> Password {
let params = scrypt::ScryptParams::new(11, 8, 1).unwrap();
Password(scrypt::scrypt_simple(passwd, &params).unwrap())
}
}
impl PartialEq<&str> for Password {
fn eq(&self, other: &&str) -> bool {
scrypt::scrypt_check(*other, &self.0).is_ok()
}
}
impl Into<Password> for String {
fn into(self) -> Password {
Password::new(&self)
}
}
// Convert itself to a hash String for db operations
impl Into<String> for Password {
fn into(self) -> String {
self.0
}
}
// A raw User returned from database
// we need to wrap the password in the Password type
#[derive(Queryable)]
struct UserQuery {
pub id: i32,
pub email: String,
pub password: String,
@ -25,6 +57,31 @@ pub struct User {
pub version: String
}
impl Into<User> for UserQuery {
fn into(self) -> User {
User {
id: self.id,
email: self.email,
// We can directly construct Password here
// because it's already the hashed value from db
password: Password(self.password),
pw_cost: self.pw_cost,
pw_nonce: self.pw_nonce,
version: self.version
}
}
}
#[derive(Debug)]
pub struct User {
pub id: i32,
pub email: String,
pub password: Password,
pub pw_cost: String,
pub pw_nonce: String,
pub version: String
}
#[derive(Insertable, Deserialize)]
#[table_name="users"]
pub struct NewUser {
@ -37,10 +94,18 @@ pub struct NewUser {
impl User {
pub fn create(db: &SqliteConnection, new_user: &NewUser) -> Result<(), UserOpError> {
let user_hashed = NewUser {
email: new_user.email.clone(),
password: Password::new(&new_user.password).into(),
pw_cost: new_user.pw_cost.clone(),
pw_nonce: new_user.pw_nonce.clone(),
version: new_user.version.clone()
};
match Self::find_user_by_email(db, &new_user.email) {
Ok(_) => Err(UserOpError::new("User already registered")),
Err(_) => diesel::insert_into(users::table)
.values(new_user)
.values(user_hashed)
.execute(db)
.map(|_| ())
.map_err(|_| UserOpError::new("Database error"))
@ -50,18 +115,18 @@ impl User {
pub fn find_user_by_email(db: &SqliteConnection, user_email: &str) -> Result<User, UserOpError> {
let mut results = users.filter(email.eq(user_email))
.limit(1)
.load::<User>(db)
.load::<UserQuery>(db)
.map_err(|_| UserOpError::new("Database error"))?;
if results.is_empty() {
Result::Err(UserOpError::new("No matching user found"))
} else {
Result::Ok(results.remove(0)) // Take ownership, kill the stupid Vec
Result::Ok(results.remove(0).into()) // Take ownership, kill the stupid Vec
}
}
// Create a JWT token for the current user if password matches
pub fn create_token(&self, passwd: &str) -> Result<String, UserOpError> {
if passwd != self.password {
if self.password != passwd {
Err(UserOpError::new("Password mismatch"))
} else {
jwt::Token::new(
@ -86,14 +151,14 @@ impl User {
// Change the password in database, if old password is provided
// The current instance of User model will not be mutated
pub fn change_pw(&self, db: &SqliteConnection, passwd: &str, new_passwd: &str) -> Result<(), UserOpError> {
if passwd != self.password {
if self.password != passwd {
Err(UserOpError::new("Password mismatch"))
} else {
// Update database
// TODO: Maybe we should revoke all JWTs somehow?
// maybe we can record when the user last changed?
diesel::update(users.find(self.id))
.set(password.eq(new_passwd))
.set(password.eq::<String>(Password::new(new_passwd).into()))
.execute(db)
.map(|_| ())
.map_err(|_| UserOpError::new("Database error"))

Loading…
Cancel
Save