libeufin

pw.rs (6705B)

---

 /*
   This file is part of TALER
   Copyright (C) 2026 Taler Systems SA
 
   TALER is free software; you can redistribute it and/or modify it under the
   terms of the GNU Affero General Public License as published by the Free Software
   Foundation; either version 3, or (at your option) any later version.
 
   TALER is distributed in the hope that it will be useful, but WITHOUT ANY
   WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
   A PARTICULAR PURPOSE.  See the GNU Affero General Public License for more details.
 
   You should have received a copy of the GNU Affero General Public License along with
   TALER; see the file COPYING.  If not, see <http://www.gnu.org/licenses/>
 */
 
 use anyhow::anyhow;
 use aws_lc_rs::digest::SHA256;
 use rand::{TryRng as _, rngs::SysRng};
 use taler_api::error::{ApiResult, failure};
 use taler_common::{encoding::base64, error_code::ErrorCode};
 
 // NIST Password Guidelines 2024
 const PASSWORD_MIN_LEN: usize = 8;
 const PASSWORD_MAX_LEN: usize = 64;
 
 /** Check if a string is a valid password */
 pub fn checkpw(pw: &str, check_quality: bool) -> ApiResult<()> {
     if !check_quality {
         return Ok(());
     }
     let len = pw.len();
 
     if len < PASSWORD_MIN_LEN {
         Err(failure(
             ErrorCode::BANK_PASSWORD_TOO_SHORT,
             format_args!(
                 "Password is too short, expect at least {PASSWORD_MIN_LEN} characters got {len}"
             ),
         ))
     } else if len > PASSWORD_MAX_LEN {
         Err(failure(
             ErrorCode::BANK_PASSWORD_TOO_LONG,
             format_args!(
                 "Password is too long, expect at most {PASSWORD_MAX_LEN} characters got {len}",
             ),
         ))
     } else {
         Ok(())
     }
 }
 
 #[derive(Debug, PartialEq, Eq)]
 pub struct PwCheck {
     pub matches: bool,
     pub outdated: bool,
 }
 
 pub enum PwCrypto {
     Bcrypt { cost: u32 },
     Sha256,
 }
 
 fn bcrypt(cost: u32, salt: [u8; 16], pw: &[u8]) -> [u8; 24] {
     // The bcrypt spec specifies that passwords should be null terminated
     // strings, but if longer than 72 bytes, are truncated at 72 bytes (thereby
     // losing the null byte at the end).
     let copy_len = pw.len().min(72);
     let mut pass = [0u8; 72];
     pass[..copy_len].copy_from_slice(&pw[..copy_len]);
     let used = (copy_len + 1).min(72);
     let truncated = &pass[..used];
     bcrypt::bcrypt(cost, salt, truncated)
 }
 
 impl PwCrypto {
     /** Hash [pw] using [cfg] hashing method */
     pub fn hashpw(&self, pw: &str) -> String {
         match self {
             PwCrypto::Bcrypt { cost } => {
                 let mut salt = [0u8; 16];
                 SysRng.try_fill_bytes(&mut salt).unwrap();
                 let pwh = bcrypt(*cost, salt, pw.as_bytes());
                 format!("bcrypt${cost}${}${}", base64::fmt(salt), base64::fmt(pwh))
             }
             PwCrypto::Sha256 => {
                 let pwh = aws_lc_rs::digest::digest(&SHA256, pw.as_bytes());
                 format!("sha256${}", base64::fmt(pwh))
             }
         }
     }
 
     /** Check whether [pw] match hashed [storedPwHash] and if it should be rehashed */
     pub fn checkpw(&self, pw: &str, stored_pw_hash: &str) -> anyhow::Result<PwCheck> {
         let (alg, args) = stored_pw_hash
             .split_once('$')
             .ok_or(anyhow!("bad password hash format"))?;
         let (matches, outdated) = match alg {
             "sha256" => {
                 let [hash] = split_n(args, '$').ok_or(anyhow!("bad password hash format"))?;
                 let pwh = aws_lc_rs::digest::digest(&SHA256, pw.as_bytes());
                 let pwh = base64::encode(pwh);
                 (pwh == hash, true)
             }
             "sha256-salted" => {
                 let [salt, hash] = split_n(args, '$').ok_or(anyhow!("bad password hash format"))?;
                 let pwh = aws_lc_rs::digest::digest(&SHA256, format!("{salt}|{pw}").as_bytes());
                 let pwh = base64::encode(pwh);
                 (pwh == hash, true)
             }
             "bcrypt" => {
                 let [cost, salt, hash] =
                     split_n(args, '$').ok_or(anyhow!("bad password hash format"))?;
                 let cost: u32 = cost.parse()?;
                 let salt = base64::decode(salt)?
                     .try_into()
                     .map_err(|_| anyhow!("bad password hash format"))?;
                 let pwh = bcrypt(cost, salt, pw.as_bytes());
                 let pwh = base64::encode(pwh);
                 (
                     pwh == hash,
                     match self {
                         PwCrypto::Bcrypt { cost: expected } => cost != *expected,
                         PwCrypto::Sha256 => false,
                     },
                 )
             }
             alg => return Err(anyhow!("unsupported hash algo: {alg}")),
         };
 
         Ok(PwCheck { matches, outdated })
     }
 }
 
 fn split_n<const N: usize>(input: &str, sep: char) -> Option<[&str; N]> {
     let mut iter = input.split(sep);
 
     let mut result = [""; N];
 
     for split in result.iter_mut().take(N) {
         *split = iter.next()?;
     }
 
     if iter.next().is_some() {
         None
     } else {
         Some(result)
     }
 }
 
 #[test]
 fn pwh() {
     let pw = "myinsecurepw";
     let crypto = PwCrypto::Bcrypt { cost: 4 };
     // Check roundtrip
     let hash = crypto.hashpw(pw);
     assert_eq!(
         crypto.checkpw(pw, &hash).unwrap(),
         PwCheck {
             matches: true,
             outdated: false
         }
     );
     assert_eq!(
         crypto.checkpw("other", &hash).unwrap(),
         PwCheck {
             matches: false,
             outdated: false
         }
     );
 
     // Check outdated algorithm
     let outdated = PwCrypto::Sha256.hashpw(pw);
     assert_eq!(
         crypto.checkpw(pw, &outdated).unwrap(),
         PwCheck {
             matches: true,
             outdated: true
         }
     );
     assert_eq!(
         crypto.checkpw("other", &outdated).unwrap(),
         PwCheck {
             matches: false,
             outdated: true
         }
     );
 
     // Check outdated options
     let better = PwCrypto::Bcrypt { cost: 5 };
     assert_eq!(
         better.checkpw(pw, &hash).unwrap(),
         PwCheck {
             matches: true,
             outdated: true
         }
     );
     assert_eq!(
         better.checkpw("other", &hash).unwrap(),
         PwCheck {
             matches: false,
             outdated: true
         }
     );
 
     // Check compatibility with kotlin hashes
     let hash = "bcrypt$4$PfNp4JBeMU/t5mS5zaUY3A==$0Tjw0KzNA3ca3y9BVkh/e3TJDlHsdkEA";
     assert_eq!(
         crypto.checkpw("password", hash).unwrap(),
         PwCheck {
             matches: true,
             outdated: false
         }
     );
 }