altcha 2.0.0 → 2.0.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
checksums.yaml CHANGED
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  SHA256:
3
- metadata.gz: 614821123caf617aa6fa7cb26f4f9accedb5147d7e8f96ad51e6b785ac769029
4
- data.tar.gz: d1fb7cf2d8599ae569c0b15973e0af96315e45863733ad97b7013dd2e982b7ef
3
+ metadata.gz: aa3024a2d52d47905ebe5d5c46580e25254eea39f3e3594518504753941857f0
4
+ data.tar.gz: 82f3ec91b73f8fd0445e023213b0217344ed1bc606bbdcd5df1c6366428c4a2f
5
5
  SHA512:
6
- metadata.gz: b09b0f6917754cfa1a2db31d8bbe35a505cf2e8a81f948079ea7460a90d6cebfc9f16c576ed598fdd8079568821e559c5b91bb479de65f634347bcf39b513a31
7
- data.tar.gz: 8fdc4d5ae63d8f17843f20c55f4343bcf310ef80da3938dc437f9f20d4081b2da8984309e6faf556bb14b66dfca3db667111f19946068c5c493fc881a7bc2c1e
6
+ metadata.gz: 65ce019b295fb69ad6b7a84c0ed3230265275ce14bd28dc4cfb238b4a3c34f54255c2e38e5369cb437dabf7de39b26cad6c7882dc1c25856b58b5d41eebe2b0c
7
+ data.tar.gz: 22784f9ace9393b325603e72ec476d08f504af8ec775f8e5fa1cfe0b9c1774e81ab481027870f961364b07ea273ccd414a645d018007d5dd7576b9af5e4f4b34
data/Gemfile.lock CHANGED
@@ -1,7 +1,7 @@
1
1
  PATH
2
2
  remote: .
3
3
  specs:
4
- altcha (2.0.0)
4
+ altcha (2.0.1)
5
5
  base64
6
6
 
7
7
  GEM
@@ -9,7 +9,7 @@ GEM
9
9
  specs:
10
10
  base64 (0.3.0)
11
11
  diff-lcs (1.6.2)
12
- rake (13.3.1)
12
+ rake (13.4.2)
13
13
  rspec (3.13.2)
14
14
  rspec-core (~> 3.13.0)
15
15
  rspec-expectations (~> 3.13.0)
data/lib/altcha/v2.rb CHANGED
@@ -484,13 +484,16 @@ module Altcha
484
484
  )
485
485
  end
486
486
 
487
- # 4b. Slow path: re-derive key from the submitted counter and compare.
487
+ # 4b. Slow path: re-derive key from the submitted counter and compare,
488
+ # and require it to satisfy the signed key prefix.
488
489
  nonce_bytes = [challenge.parameters.nonce].pack('H*')
489
490
  salt_bytes = [challenge.parameters.salt].pack('H*')
490
491
  password_bytes = make_password(nonce_bytes, solution.counter)
491
492
  derived_key_bytes = derive_key(challenge.parameters, salt_bytes, password_bytes)
492
493
  derived_key_hex = derived_key_bytes.unpack1('H*')
493
- invalid = !constant_time_equal?(derived_key_hex, solution.derived_key)
494
+ key_matches = constant_time_equal?(derived_key_hex, solution.derived_key)
495
+ prefix_matches = derived_key_hex.start_with?(challenge.parameters.key_prefix)
496
+ invalid = !(key_matches && prefix_matches)
494
497
 
495
498
  VerifySolutionResult.new(
496
499
  expired: false, invalid_signature: false, invalid_solution: invalid,
@@ -1,5 +1,5 @@
1
1
  # frozen_string_literal: true
2
2
 
3
3
  module Altcha
4
- VERSION = '2.0.0'
4
+ VERSION = '2.0.1'
5
5
  end
metadata CHANGED
@@ -1,14 +1,14 @@
1
1
  --- !ruby/object:Gem::Specification
2
2
  name: altcha
3
3
  version: !ruby/object:Gem::Version
4
- version: 2.0.0
4
+ version: 2.0.1
5
5
  platform: ruby
6
6
  authors:
7
7
  - Daniel Regeci
8
8
  autorequire:
9
9
  bindir: exe
10
10
  cert_chain: []
11
- date: 2026-04-07 00:00:00.000000000 Z
11
+ date: 2026-07-30 00:00:00.000000000 Z
12
12
  dependencies:
13
13
  - !ruby/object:Gem::Dependency
14
14
  name: base64