mirrors/prosody
1
0
Fork 0
mirror of https://github.com/bjc/prosody.git synced 2025-04-04 05:37:39 +03:00
Code Issues Projects Releases Packages Wiki Activity Actions

mod_auth_internal_hashed: Up iteration count to 10000 per XEP-0438

Browse source 
More security for less pain than switching to SCRAM-SHA-256

The XEP will likely be change to reference the RFC that will probably
come from draft-ietf-kitten-password-storage once it is ready, and then
we should update to follow that.
This commit is contained in:
Kim Alvefur 2021-12-26 16:51:04 +01:00
parent c122d673e6
commit 4261dc1d80
3 changed files with 9 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

7
doc/doap.xml
View file

@ -785,6 +785,13 @@
<xmpp:note>mod_muc</xmpp:note> <xmpp:note>mod_muc</xmpp:note>
</xmpp:SupportedXep> </xmpp:SupportedXep>
</implements> </implements>
<implements>
<xmpp:SupportedXep>
<xmpp:xep rdf:resource="https://xmpp.org/extensions/xep-0438.html"/>
<xmpp:version>0.2.0</xmpp:version>
<xmpp:status>partial</xmpp:status>
</xmpp:SupportedXep>
</implements>
<implements> <implements>
<xmpp:SupportedXep> <xmpp:SupportedXep>
<xmpp:xep rdf:resource="https://xmpp.org/extensions/xep-0441.html"/> <xmpp:xep rdf:resource="https://xmpp.org/extensions/xep-0441.html"/>

2
plugins/mod_auth_internal_hashed.lua
View file

@ -28,7 +28,7 @@ local get_auth_db = assert(scram_hashers[hash_name], "SCRAM-"..hash_name.." not
local scram_name = "scram_"..hash_name:gsub("%-","_"):lower(); local scram_name = "scram_"..hash_name:gsub("%-","_"):lower();
-- Default; can be set per-user -- Default; can be set per-user
local default_iteration_count = module:get_option_number("default_iteration_count", 4096); local default_iteration_count = module:get_option_number("default_iteration_count", 10000);
-- define auth provider -- define auth provider
local provider = {}; local provider = {};

2
util/sasl/scram.lua
View file

@ -41,7 +41,7 @@ Supported Channel Binding Backends
'tls-unique' according to RFC 5929 'tls-unique' according to RFC 5929
]] ]]
local default_i = 4096 local default_i = 10000
local function validate_username(username, _nodeprep) local function validate_username(username, _nodeprep)
-- check for forbidden char sequences -- check for forbidden char sequences