altcha 2.0.0 → 2.0.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/Gemfile.lock +2 -2
- data/lib/altcha/v2.rb +5 -2
- data/lib/altcha/version.rb +1 -1
- metadata +2 -2
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
SHA256:
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
3
|
+
metadata.gz: aa3024a2d52d47905ebe5d5c46580e25254eea39f3e3594518504753941857f0
|
|
4
|
+
data.tar.gz: 82f3ec91b73f8fd0445e023213b0217344ed1bc606bbdcd5df1c6366428c4a2f
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: 65ce019b295fb69ad6b7a84c0ed3230265275ce14bd28dc4cfb238b4a3c34f54255c2e38e5369cb437dabf7de39b26cad6c7882dc1c25856b58b5d41eebe2b0c
|
|
7
|
+
data.tar.gz: 22784f9ace9393b325603e72ec476d08f504af8ec775f8e5fa1cfe0b9c1774e81ab481027870f961364b07ea273ccd414a645d018007d5dd7576b9af5e4f4b34
|
data/Gemfile.lock
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
PATH
|
|
2
2
|
remote: .
|
|
3
3
|
specs:
|
|
4
|
-
altcha (2.0.
|
|
4
|
+
altcha (2.0.1)
|
|
5
5
|
base64
|
|
6
6
|
|
|
7
7
|
GEM
|
|
@@ -9,7 +9,7 @@ GEM
|
|
|
9
9
|
specs:
|
|
10
10
|
base64 (0.3.0)
|
|
11
11
|
diff-lcs (1.6.2)
|
|
12
|
-
rake (13.
|
|
12
|
+
rake (13.4.2)
|
|
13
13
|
rspec (3.13.2)
|
|
14
14
|
rspec-core (~> 3.13.0)
|
|
15
15
|
rspec-expectations (~> 3.13.0)
|
data/lib/altcha/v2.rb
CHANGED
|
@@ -484,13 +484,16 @@ module Altcha
|
|
|
484
484
|
)
|
|
485
485
|
end
|
|
486
486
|
|
|
487
|
-
# 4b. Slow path: re-derive key from the submitted counter and compare
|
|
487
|
+
# 4b. Slow path: re-derive key from the submitted counter and compare,
|
|
488
|
+
# and require it to satisfy the signed key prefix.
|
|
488
489
|
nonce_bytes = [challenge.parameters.nonce].pack('H*')
|
|
489
490
|
salt_bytes = [challenge.parameters.salt].pack('H*')
|
|
490
491
|
password_bytes = make_password(nonce_bytes, solution.counter)
|
|
491
492
|
derived_key_bytes = derive_key(challenge.parameters, salt_bytes, password_bytes)
|
|
492
493
|
derived_key_hex = derived_key_bytes.unpack1('H*')
|
|
493
|
-
|
|
494
|
+
key_matches = constant_time_equal?(derived_key_hex, solution.derived_key)
|
|
495
|
+
prefix_matches = derived_key_hex.start_with?(challenge.parameters.key_prefix)
|
|
496
|
+
invalid = !(key_matches && prefix_matches)
|
|
494
497
|
|
|
495
498
|
VerifySolutionResult.new(
|
|
496
499
|
expired: false, invalid_signature: false, invalid_solution: invalid,
|
data/lib/altcha/version.rb
CHANGED
metadata
CHANGED
|
@@ -1,14 +1,14 @@
|
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
|
2
2
|
name: altcha
|
|
3
3
|
version: !ruby/object:Gem::Version
|
|
4
|
-
version: 2.0.
|
|
4
|
+
version: 2.0.1
|
|
5
5
|
platform: ruby
|
|
6
6
|
authors:
|
|
7
7
|
- Daniel Regeci
|
|
8
8
|
autorequire:
|
|
9
9
|
bindir: exe
|
|
10
10
|
cert_chain: []
|
|
11
|
-
date: 2026-
|
|
11
|
+
date: 2026-07-30 00:00:00.000000000 Z
|
|
12
12
|
dependencies:
|
|
13
13
|
- !ruby/object:Gem::Dependency
|
|
14
14
|
name: base64
|