argon2 1.1.0 → 1.1.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 4db0f3233c1faa582f56da4f70611158490822e6
-  data.tar.gz: 7261aba06880156bf240786b4b12016f7834d2fa
+  metadata.gz: 26929d636f73b4f3c98bde188d48b24b131917fd
+  data.tar.gz: 462fc7ac63ca0eae48f305a558ba672f1ebb4e07
 SHA512:
-  metadata.gz: f55caacf26f22e15c4a1ab91deca56b65556bc52e0203b78110f48afd9fa94bc398c7b116adbad916309fddd00fe237d16647b162f4b4d3db0cdea44501d93b4
-  data.tar.gz: 27e7638366fc322d518c7ffaeb48b35b10426c1253794c67cf0e32dcc9ef01ffeaafdfe32f8c2b0ef53ab998319eb94d08d0c7d29012862c63fbdab1e944d2df
+  metadata.gz: 30aebe1344c7deba53ae02e8fcbb64f8b5146b5d294e7b9f00988743db773df4e7cad406f4649019cbfe76ecb67e11cf138f7992b833cb20b1c11f0f25e1497f
+  data.tar.gz: 4de3263e33b95fd4ed997e1d413ee5446c2008ae4653c390aee0dd8170bfcd3b96f37ea03ef5e667148aff13b496a921368ef40d7b49dfd585e66f5b7a69e2fa

data/.rubocop.yml

@@ -1,14 +1,13 @@
-# This configuration was generated by
-#. `rubocop --auto-gen-config`
+
 Metrics/AbcSize:
-  Max: 18
+  Max: 20
 Metrics/CyclomaticComplexity:
   Enabled: false
 Metrics/PerceivedComplexity:
   Enabled: false
-Style/MutableConstant:
-  Exclude:
-    - 'test/key_test.rb'
+#Style/MutableConstant:
+#  Exclude:
+#    - 'test/key_test.rb'
 
 Metrics/LineLength:
   Max: 160
@@ -60,3 +59,9 @@ Style/StringLiterals:
 
 Style/WordArray:
   MinSize: 33
+
+Style/MultilineMethodCallBraceLayout:
+  Exclude:
+    - 'lib/argon2.rb'
+    - 'test/low_level_test.rb'
+

data/Changelog.md

@@ -1,4 +1,10 @@
-## v1.0.0: 2015-03-07
+## v1.1.1: 2016-09-21
+- Fix verify against externally created hashes with different salt lengths
+
+## v1.1.0: ?
+- Backward compat with version 1.0 hashes
+
+## v1.0.0: 2016-03-07
 - API change - 'new' becomes 'create'
 - Version 1.3 of the Argon2 algorithm pulled in
 

data/README.md

@@ -11,7 +11,7 @@ This Ruby Gem provides FFI bindings, and a simplified interface, to the Argon2 a
 
 This project has several key tenants to its design:
 
-* The reference Argon2 implementation is to be used "unaltered". To ensure compliance with this goal, and encourage regular updates from upstream, the upstrema library is implemented as a git submodule, and is intended to stay that way.
+* The reference Argon2 implementation is to be used "unaltered". To ensure compliance with this goal, and encourage regular updates from upstream, the upstream library is implemented as a git submodule, and is intended to stay that way.
 * The FFI interface is kept as slim as possible, with wrapper classes preferred to implementing context structs in FFI
 * Security and maintainability take top priority. This can have an impact on platform support. A PR that contains platform specific code paths is unlikely to be accepted.
 * Tested platforms are MRI Ruby 2.2, 2.3 and JRuby 9000. No assertions are made on other platforms.

data/Rakefile

@@ -7,6 +7,7 @@ RuboCop::RakeTask.new
 Rake::TestTask.new(:test) do |t|
   t.libs << "test"
   t.libs << "lib"
+  t.warning = true
   t.test_files = FileList['test/**/*_test.rb']
 end
 

data/ext/argon2_wrap/argon_wrap.c

@@ -20,7 +20,7 @@
 #define THREADS_DEF 1
 #define OUT_LEN 32
 #define SALT_LEN 16
-#define ENCODE_LEN 112
+#define ENCODE_LEN 96 /* Does not include SALT LEN */
 
 /* Workaround for https://github.com/technion/ruby-argon2/issues/8. Hopefully temporary */
 static int wrap_compare(const uint8_t *b1, const uint8_t *b2, size_t len) {
@@ -34,8 +34,8 @@ static int wrap_compare(const uint8_t *b1, const uint8_t *b2, size_t len) {
 }
 
 unsigned int argon2_wrap(char *out, const char *pwd, size_t pwd_length,
-        uint8_t *salt, uint32_t t_cost, uint32_t m_cost, uint32_t lanes, 
-        uint8_t *secret, size_t secretlen)
+        uint8_t *salt,  uint32_t saltlen, uint32_t t_cost, uint32_t m_cost, 
+        uint32_t lanes, uint8_t *secret, size_t secretlen)
 {
     uint8_t hash[OUT_LEN];
     argon2_context context;
@@ -53,7 +53,7 @@ unsigned int argon2_wrap(char *out, const char *pwd, size_t pwd_length,
     context.pwd = (uint8_t *)pwd;
     context.pwdlen = pwd_length;
     context.salt = salt;
-    context.saltlen = SALT_LEN;
+    context.saltlen = saltlen;
     context.secret = secret;
     context.secretlen = secretlen;
     context.ad = NULL;
@@ -71,7 +71,7 @@ unsigned int argon2_wrap(char *out, const char *pwd, size_t pwd_length,
     if (result != ARGON2_OK)
         return result;
 
-    encode_string(out, ENCODE_LEN, &context, Argon2_i);
+    encode_string(out, ENCODE_LEN + saltlen, &context, Argon2_i);
     return ARGON2_OK;
 }
  
@@ -81,7 +81,7 @@ int wrap_argon2_verify(const char *encoded, const char *pwd,
 {
     argon2_context ctx;
     int ret;
-    char out[ENCODE_LEN];
+    char *out;
     memset(&ctx, 0, sizeof(argon2_context));
     size_t encoded_len;
     
@@ -108,7 +108,15 @@ int wrap_argon2_verify(const char *encoded, const char *pwd,
         return ARGON2_DECODING_FAIL;
     } 
 
-    ret = argon2_wrap(out, pwd, pwdlen, ctx.salt, ctx.t_cost, 
+    out = malloc(ENCODE_LEN + ctx.saltlen);
+    if(!out) {
+        free(ctx.ad);
+        free(ctx.salt);
+        free(ctx.out);
+        return ARGON2_DECODING_FAIL;
+    }
+
+    ret = argon2_wrap(out, pwd, pwdlen, ctx.salt, ctx.saltlen, ctx.t_cost, 
            ctx.m_cost, ctx.lanes, secret, secretlen);
 
     free(ctx.ad);
@@ -117,9 +125,11 @@ int wrap_argon2_verify(const char *encoded, const char *pwd,
     if (ret != ARGON2_OK || wrap_compare((uint8_t*)out, (uint8_t*)encoded, 
                 strlen(encoded))) {
         free(ctx.out);
+        free(out);
         return ARGON2_DECODING_FAIL;
     }
     free(ctx.out);
+    free(out);
 
     return ARGON2_OK;
 }

data/ext/argon2_wrap/test.c

@@ -37,8 +37,8 @@ int argon2i_hash_raw(const uint32_t t_cost, const uint32_t m_cost,
 */
 
 unsigned int argon2_wrap(char *out, const char *pwd, size_t pwd_length,
-    uint8_t *salt, uint32_t t_cost, uint32_t m_cost, uint32_t lanes,
-    uint8_t *secret, size_t secretlen);
+    uint8_t *salt, uint32_t saltlen, uint32_t t_cost, uint32_t m_cost, 
+    uint32_t lanes, uint8_t *secret, size_t secretlen);
 
 int wrap_argon2_verify(const char *encoded, const char *pwd,
     const size_t pwdlen,
@@ -81,7 +81,7 @@ int main()
 
 #define WRAP_TEST(T, M, PWD, REF) \
     pwd = strdup(PWD); \
-    argon2_wrap(out2, pwd, strlen(PWD), salt, T, 1<<M, 1, NULL, 0); \
+    argon2_wrap(out2, pwd, strlen(PWD), salt, sizeof(salt),T, 1<<M, 1, NULL, 0); \
     free(pwd); \
     assert(memcmp(out2, REF, strlen(REF)) == 0); \
     printf( "Ref test: %s: PASS\n", REF);

data/lib/argon2/ffi_engine.rb

@@ -16,12 +16,12 @@ module Argon2
       :uint, :uint, :uint, :pointer,
       :size_t, :pointer, :size_t, :pointer, :size_t], :int, :blocking => true
 
-    # void argon2_wrap(uint8_t *out, char *pwd, size_it pwdlen,
-    # uint8_t *salt, uint32_t t_cost,
+    # void argon2_wrap(uint8_t *out, char *pwd, size_t pwdlen,
+    # uint8_t *salt, uint32_t saltlen, uint32_t t_cost,
     #    uint32_t m_cost, uint32_t lanes,
     #    uint8_t *secret, uint32_t secretlen)
     attach_function :argon2_wrap, [
-      :pointer, :pointer, :size_t, :pointer, :uint,
+      :pointer, :pointer, :size_t, :pointer, :uint, :uint,
       :uint, :uint, :pointer, :size_t], :uint, :blocking => true
 
     # int argon2i_verify(const char *encoded, const void *pwd,
@@ -54,7 +54,7 @@ module Argon2
       end
       FFI::MemoryPointer.new(:char, Constants::ENCODE_LEN) do |buffer|
         ret = Ext.argon2_wrap(buffer, password, passwordlen,
-            salt, t_cost, (1 << m_cost),
+            salt, salt.length, t_cost, (1 << m_cost),
             1, secret, secretlen)
         raise ArgonHashFail, ERRORS[ret.abs] unless ret == 0
         result = buffer.read_string(Constants::ENCODE_LEN)

data/lib/argon2/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 # Standard Gem version constant.
 module Argon2
-  VERSION = "1.1.0".freeze
+  VERSION = "1.1.1".freeze
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: argon2
 version: !ruby/object:Gem::Version
-  version: 1.1.0
+  version: 1.1.1
 platform: ruby
 authors:
 - Technion
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2016-05-01 00:00:00.000000000 Z
+date: 2016-09-21 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: ffi
@@ -146,6 +146,7 @@ files:
 - ext/argon2_wrap/extconf.rb
 - ext/argon2_wrap/libargon2_wrap.so
 - ext/argon2_wrap/test.c
+- ext/argon2_wrap/tests
 - ext/phc-winner-argon2/.git
 - ext/phc-winner-argon2/.gitattributes
 - ext/phc-winner-argon2/.gitignore