crypt_checkpass 1

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA1:
+  metadata.gz: 189e02218459b7aa4eeb3ff0b6efbecfa49fe612
+  data.tar.gz: 403f8ca9c8a0e0dec7caff6767b7f5075c56ce8c
+SHA512:
+  metadata.gz: 5b0c2eb040e52fa190fc04089e42c6d3d1f971be6d925ea10d5bb036ea0685607d3b7702eee8b3b579b5a4afd287860a0bad1fae22153837bc2149952e3b42b6
+  data.tar.gz: 5fd897d06a1651e583ebaaf39a66a2d76817fb6a2fe26742c5e77ddf6f378222f371a354e1866c6a9e9ca6593d257a96084ee264b3231a2ca932e04055ad902e

data/.gitignore

@@ -0,0 +1,32 @@
+# Copyright (c) 2018 Urabe, Shyouhei
+#
+# Permission is hereby granted, free of  charge, to any person obtaining a copy
+# of this software and associated documentation files (the "Software"), to deal
+# in the Software without restriction,  including without limitation the rights
+# to use,  copy, modify,  merge, publish,  distribute, sublicense,  and/or sell
+# copies  of the  Software,  and to  permit  persons to  whom  the Software  is
+# furnished to do so, subject to the following conditions:
+#
+#       The above copyright notice and this permission notice shall be
+#       included in all copies or substantial portions of the Software.
+#
+# THE SOFTWARE  IS PROVIDED "AS IS",  WITHOUT WARRANTY OF ANY  KIND, EXPRESS OR
+# IMPLIED,  INCLUDING BUT  NOT LIMITED  TO THE  WARRANTIES OF  MERCHANTABILITY,
+# FITNESS FOR A  PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO  EVENT SHALL THE
+# AUTHORS  OR COPYRIGHT  HOLDERS  BE LIABLE  FOR ANY  CLAIM,  DAMAGES OR  OTHER
+# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+# SOFTWARE.
+
+*.bundle
+.DS_Store
+/.byebug_history
+/.ruby-version
+/.yardoc/
+/_yardoc/
+/coverage/
+/doc/
+/pkg/
+/tmp/
+/vendor/
+Gemfile.lock

data/.rubocop.yml

@@ -0,0 +1,96 @@
+#! /your/favourite/path/to/rubocop
+# -*- mode: yaml; coding: utf-8  -*-
+
+# Copyright (c) 2018 Urabe, Shyouhei
+#
+# Permission is hereby granted, free of  charge, to any person obtaining a copy
+# of this software and associated documentation files (the "Software"), to deal
+# in the Software without restriction,  including without limitation the rights
+# to use,  copy, modify,  merge, publish,  distribute, sublicense,  and/or sell
+# copies  of the  Software,  and to  permit  persons to  whom  the Software  is
+# furnished to do so, subject to the following conditions:
+#
+#       The above copyright notice and this permission notice shall be
+#       included in all copies or substantial portions of the Software.
+#
+# THE SOFTWARE  IS PROVIDED "AS IS",  WITHOUT WARRANTY OF ANY  KIND, EXPRESS OR
+# IMPLIED,  INCLUDING BUT  NOT LIMITED  TO THE  WARRANTIES OF  MERCHANTABILITY,
+# FITNESS FOR A  PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO  EVENT SHALL THE
+# AUTHORS  OR COPYRIGHT  HOLDERS  BE LIABLE  FOR ANY  CLAIM,  DAMAGES OR  OTHER
+# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+# SOFTWARE.
+
+AllCops:
+  DisabledByDefault: false
+  DisplayCopNames: true
+  Exclude:
+    - 'vendor/**/*'
+    - 'test/**/*'
+    - 'ext/**/*'
+    - '*.gemspec'
+  TargetRubyVersion: 2.0
+
+Layout:
+  Enabled: false
+
+Lint/AmbiguousBlockAssociation:
+  Enabled: false
+
+Lint/AssignmentInCondition:
+  Enabled: false
+
+Lint/EmptyWhen:
+  Enabled: false
+
+Lint/ScriptPermission:
+  Enabled: false
+
+Lint/UselessAccessModifier:
+  # I think this cop is buggy as of 0.49
+  Enabled: false
+
+Lint/UnderscorePrefixedVariableName:
+  Enabled: false
+  
+Lint/UnusedMethodArgument:
+  Enabled: false
+
+Metrics/AbcSize:
+  Enabled: false
+
+Metrics/BlockLength:
+  Enabled: false
+
+Metrics/ClassLength:
+  Enabled: false
+
+Metrics/CyclomaticComplexity:
+  Enabled: false
+
+Metrics/MethodLength:
+  Enabled: false
+
+Metrics/PerceivedComplexity:
+  # What the f* is this thing?
+  Enabled: false
+
+Performance:
+  Enabled: false
+
+Rails:
+  Enabled: false
+
+Security/Eval:
+  Enabled: false
+
+Security/MarshalLoad:
+  Enabled: false
+
+Style:
+  Enabled: false
+
+Metrics/LineLength:
+  Enabled: false
+  AllowURI: true
+  Max: 80

data/.yardopts

@@ -0,0 +1,5 @@
+--markup-provider=redcarpet
+--markup=markdown
+--charset utf-8
+--readme README.md
+lib/**/*.rb

data/Gemfile

@@ -0,0 +1,41 @@
+#! /your/favourite/path/to/bundler
+# -*- mode: ruby; coding: utf-8; indent-tabs-mode: nil; ruby-indent-level: 2 -*-
+# -*- frozen_string_literal: true -*-
+# -*- warn_indent: true -*-
+
+# Copyright (c) 2018 Urabe, Shyouhei
+#
+# Permission is hereby granted, free of  charge, to any person obtaining a copy
+# of this software and associated documentation files (the "Software"), to deal
+# in the Software without restriction,  including without limitation the rights
+# to use,  copy, modify,  merge, publish,  distribute, sublicense,  and/or sell
+# copies  of the  Software,  and to  permit  persons to  whom  the Software  is
+# furnished to do so, subject to the following conditions:
+#
+#       The above copyright notice and this permission notice shall be
+#       included in all copies or substantial portions of the Software.
+#
+# THE SOFTWARE  IS PROVIDED "AS IS",  WITHOUT WARRANTY OF ANY  KIND, EXPRESS OR
+# IMPLIED,  INCLUDING BUT  NOT LIMITED  TO THE  WARRANTIES OF  MERCHANTABILITY,
+# FITNESS FOR A  PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO  EVENT SHALL THE
+# AUTHORS  OR COPYRIGHT  HOLDERS  BE LIABLE  FOR ANY  CLAIM,  DAMAGES OR  OTHER
+# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+# SOFTWARE.
+
+source 'https://rubygems.org'
+gemspec
+
+group :test do
+  gem 'argon2'
+  gem 'bcrypt'
+  gem 'scrypt'
+  gem 'unix-crypt'
+  if RUBY_VERSION >= '2.1.0'
+    gem 'stackprof'
+  end
+  if RUBY_VERSION >= '2.3.0'
+    gem 'fiddle'
+    gem 'openssl'
+  end
+end

data/LICENSE.txt

@@ -0,0 +1,19 @@
+Copyright (c) 2018 Urabe, Shyouhei
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of
+this software and  associated documentation files (the "Software"),  to deal in
+the Software  without restriction, including  without limitation the  rights to
+use, copy, modify,  merge, publish, distribute, sublicense,  and/or sell copies
+of the Software, and to permit persons  to whom the Software is furnished to do
+so, subject to the following conditions:
+
+        The above copyright notice and this permission notice shall be
+        included in all copies or substantial portions of the Software.
+
+THE SOFTWARE  IS PROVIDED  "AS IS",  WITHOUT WARRANTY OF  ANY KIND,  EXPRESS OR
+IMPLIED,  INCLUDING  BUT NOT  LIMITED  TO  THE WARRANTIES  OF  MERCHANTABILITY,
+FITNESS FOR  A PARTICULAR PURPOSE  AND NONINFRINGEMENT.  IN NO EVENT  SHALL THE
+AUTHORS  OR  COPYRIGHT HOLDERS  BE  LIABLE  FOR  ANY  CLAIM, DAMAGES  OR  OTHER
+LIABILITY, WHETHER IN  AN ACTION OF CONTRACT, TORT OR  OTHERWISE, ARISING FROM,
+OUT OF OR IN  CONNECTION WITH THE SOFTWARE OR THE USE OR  OTHER DEALINGS IN THE
+SOFTWARE.

data/README.md

@@ -0,0 +1,114 @@
+Provides Unix crypt_checkpass(3)-compatible routines.
+
+### What's good with this API?
+
+- It supports vast majority of hash verifications, including those
+  which are not generated by us (see below). This enables smooth
+  migration of password algorithm; you can mix multiple algorithms to
+  verify.  This is practically very important because from time to
+  time, current best practice moves from one thing to another.
+- Generates a variety of hash strings using current-best-practice hash
+  functions.
+
+### Tell me the usage?
+
+Verification:
+
+```ruby
+require 'crypt_checkpass'
+actual   = 'p455w0rd'
+expected = '$5$$D1W6NDlv302WsleruXoUN279B87yf6dFN4ZZhFqV6DD'
+crypt_checkpass(actual, expected) or raise 'NG'
+```
+
+Generation:
+
+```ruby
+require 'crypt_checkpass'
+crypt_newhash('p455w0rd',
+  id: 'argon2i',
+  m_cost: 4096,
+  t_cost: 3) # => "$argon2i$v=19$m=4096,t=3,p=1$cXdlc..."
+```
+
+Or, if you are a real OpenBSD fan, you can also do this:
+
+```ruby
+require 'crypt_checkpass'
+crypt_newhash('p455w0rd', 'bcrypt,12') # => "$2b$12$gCDJbfcg..."
+```
+
+### Which hash function is supported?
+
+|prefix    |id                |supported| depends  |
+|:-------- |:---------------- |:-------:|:-------- |
+|(none)    |DES(traditional)  |NO |(1)             |
+|`_`       |DES(BSDi extended)|NO |(2)             |
+|`$1$`     |MD5               |NO |(2)             |
+|`$2`      |bcrypt            |YES|`bcrypt` gem    |
+|`$3$`     |BSD NThash        |NO |(2)             |
+|`$5$`     |SHA256            |YES|`unix-crypt` gem|
+|`$6$`     |SHA512            |YES|`unix-crypt` gem|
+|`$argon2` |argon2            |YES|`argon2` gem    |
+|`$pbkdf2` |PBKFD2            |YES|`openssl` gem   |
+|(3)       |scrypt            |YES|`scrypt` gem    |
+
+- note (1): instead of falling back to traditional mode which is
+  considered absolutely insecure, this library prohibits this kind of
+  input and renders errors.
+- note (2): These formats are considered archaic.
+- note (3): scypt gem generates password string that is not prefixed.
+
+### Too many functions are there! What is the current best practice?
+
+If in doubt use argon2.  It was designed to establish "standard to
+fulfill the needs of modern applications and to best protect against
+attackers".  As of writing there are no known flaws.
+
+### What's wrong with the stdlib `String#crypt` ?
+
+Please never use `String#crypt` any longer.  It is legacy; provided
+only for backward compatibility with ruby scripts in earlier days.  It
+is bad to use in contemporary programs for several reasons:
+
+- Behaviour of C's `crypt(3)`, which is under the hood of
+  `String#crypt`, depends on the OS it is run.  The generated digest
+  lacks data portability.
+- On some OSes such as Mac OS, this function never fails (i.e.
+  silently ends up in unexpected results).
+- On some OSes such as Mac OS, It is not thread safe.
+- So-called "traditional" usage of `crypt(3)` is very very very weak.
+  According to its manpage, Linux's traditional `crypt(3)` output only
+  has 2**56 variations; too easy to blute force today.  And this is
+  the default behaviour.
+- In order to make things robust some OSes implement so-called
+  "modular" usage. To go through, you have to do a complex build-up of
+  the parameter(salt), by hand.  Failure in generation of a proper
+  salt string tends not to yield any errors; for instance typo in
+  parameters are normally not detectable.
+    - For instance, in the following example, second invokation of
+      `String#crypt` is wrong; it has typo in "round=" (lacks "s").
+      However the call does not fail and something unexpected is
+      generated.
+      
+      ```ruby
+      "foo".crypt("$5$rounds=1000$salt$") # OK, proper usage
+      "foo".crypt("$5$round=1000$salt$")  # Typo not detected
+      ```
+
+- Even in the "modular" mode, some hash functions are considered
+  archaic and no longer recommended at all; for instance module `$1$`
+  is officially abondoned by its author:
+  http://phk.freebsd.dk/sagas/md5crypt_eol.html, for another instance
+  module `$3$` is consodered completely broken: see the manpage of
+  FreeBSD.
+- On some OS such as Mac OS, there is no modular mode. Yet, as written
+  above, `String#crypt` on Mac OS never fails.  This means even if you
+  build up a proper salt string it generates a traditional DES hash
+  anyways, and there is no way for you to be aware of.
+  
+  ```ruby
+  "foo".crypt("$5$rounds=1000$salt$") # => "$5fNPQMxC5j6."
+  ```
+
+The API this library provides is better.  Use ours instead.

data/Rakefile

@@ -0,0 +1,46 @@
+#! /your/favourite/path/to/rake
+# -*- mode: ruby; coding: utf-8; indent-tabs-mode: nil; ruby-indent-level: 2 -*-
+# -*- frozen_string_literal: true -*-
+# -*- warn_indent: true -*-
+
+# Copyright (c) 2018 Urabe, Shyouhei
+#
+# Permission is hereby granted, free of  charge, to any person obtaining a copy
+# of this software and associated documentation files (the "Software"), to deal
+# in the Software without restriction,  including without limitation the rights
+# to use,  copy, modify,  merge, publish,  distribute, sublicense,  and/or sell
+# copies  of the  Software,  and to  permit  persons to  whom  the Software  is
+# furnished to do so, subject to the following conditions:
+#
+#       The above copyright notice and this permission notice shall be
+#       included in all copies or substantial portions of the Software.
+#
+# THE SOFTWARE  IS PROVIDED "AS IS",  WITHOUT WARRANTY OF ANY  KIND, EXPRESS OR
+# IMPLIED,  INCLUDING BUT  NOT LIMITED  TO THE  WARRANTIES OF  MERCHANTABILITY,
+# FITNESS FOR A  PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO  EVENT SHALL THE
+# AUTHORS  OR COPYRIGHT  HOLDERS  BE LIABLE  FOR ANY  CLAIM,  DAMAGES OR  OTHER
+# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+# SOFTWARE.
+
+require 'bundler/gem_tasks'
+require 'bundler/gem_helper'
+require 'rake/testtask'
+require 'rubocop/rake_task'
+require 'yard/rake/yardoc_task'
+require 'yard'
+
+YARD::Rake::YardocTask.new
+RuboCop::RakeTask.new
+Rake::TestTask.new do |t|
+  t.test_files = FileList['test/**/*.rb'] - %w'test/test_helper.rb'
+  t.warning    = true
+end
+
+task default: :test
+task spec: :test
+
+task :pry do
+  sh 'bundle exec ruby bin/console', verbose: true
+end
+task console: :pry

data/bin/console

@@ -0,0 +1,29 @@
+#! /your/favourite/path/to/ruby
+# -*- mode: ruby; coding: utf-8; indent-tabs-mode: nil; ruby-indent-level: 2 -*-
+# -*- frozen_string_literal: true -*-
+# -*- warn_indent: true -*-
+
+# Copyright (c) 2017 Urabe, Shyouhei
+#
+# Permission is hereby granted, free of  charge, to any person obtaining a copy
+# of this software and associated documentation files (the "Software"), to deal
+# in the Software without restriction,  including without limitation the rights
+# to use,  copy, modify,  merge, publish,  distribute, sublicense,  and/or sell
+# copies  of the  Software,  and to  permit  persons to  whom  the Software  is
+# furnished to do so, subject to the following conditions:
+#
+#         The above copyright notice and this permission notice shall be
+#         included in all copies or substantial portions of the Software.
+#
+# THE SOFTWARE  IS PROVIDED "AS IS",  WITHOUT WARRANTY OF ANY  KIND, EXPRESS OR
+# IMPLIED,  INCLUDING BUT  NOT LIMITED  TO THE  WARRANTIES OF  MERCHANTABILITY,
+# FITNESS FOR A  PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO  EVENT SHALL THE
+# AUTHORS  OR COPYRIGHT  HOLDERS  BE LIABLE  FOR ANY  CLAIM,  DAMAGES OR  OTHER
+# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+# SOFTWARE.
+
+require 'bundler/setup'
+require 'crypt_checkpass'
+require 'pry'
+Pry.start

data/bin/setup

@@ -0,0 +1,24 @@
+#!/bin/sh
+# -*- mode: sh; coding: utf-8; indent-tabs-mode: nil -*-
+
+# Copyright (c) 2018 Urabe, Shyouhei
+#
+# Permission is hereby granted, free of  charge, to any person obtaining a copy
+# of this software and associated documentation files (the "Software"), to deal
+# in the Software without restriction,  including without limitation the rights
+# to use,  copy, modify,  merge, publish,  distribute, sublicense,  and/or sell
+# copies  of the  Software,  and to  permit  persons to  whom  the Software  is
+# furnished to do so, subject to the following conditions:
+#
+#       The above copyright notice and this permission notice shall be
+#       included in all copies or substantial portions of the Software.
+#
+# THE SOFTWARE  IS PROVIDED "AS IS",  WITHOUT WARRANTY OF ANY  KIND, EXPRESS OR
+# IMPLIED,  INCLUDING BUT  NOT LIMITED  TO THE  WARRANTIES OF  MERCHANTABILITY,
+# FITNESS FOR A  PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO  EVENT SHALL THE
+# AUTHORS  OR COPYRIGHT  HOLDERS  BE LIABLE  FOR ANY  CLAIM,  DAMAGES OR  OTHER
+# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+# SOFTWARE.
+
+bundle install

data/crypt_checkpass.gemspec

@@ -0,0 +1,55 @@
+#! /your/favourite/path/to/gem
+# -*- mode: ruby; coding: utf-8; indent-tabs-mode: nil; ruby-indent-level: 2 -*-
+# -*- frozen_string_literal: true -*-
+# -*- warn_indent: true -*-
+
+# Copyright (c) 2018 Urabe, Shyouhei
+#
+# Permission is hereby granted, free of  charge, to any person obtaining a copy
+# of this software and associated documentation files (the "Software"), to deal
+# in the Software without restriction,  including without limitation the rights
+# to use,  copy, modify,  merge, publish,  distribute, sublicense,  and/or sell
+# copies  of the  Software,  and to  permit  persons to  whom  the Software  is
+# furnished to do so, subject to the following conditions:
+#
+#       The above copyright notice and this permission notice shall be
+#       included in all copies or substantial portions of the Software.
+#
+# THE SOFTWARE  IS PROVIDED "AS IS",  WITHOUT WARRANTY OF ANY  KIND, EXPRESS OR
+# IMPLIED,  INCLUDING BUT  NOT LIMITED  TO THE  WARRANTIES OF  MERCHANTABILITY,
+# FITNESS FOR A  PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO  EVENT SHALL THE
+# AUTHORS  OR COPYRIGHT  HOLDERS  BE LIABLE  FOR ANY  CLAIM,  DAMAGES OR  OTHER
+# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+# SOFTWARE.
+
+Gem::Specification.new do |spec|
+  spec.name          = 'crypt_checkpass'
+  spec.version       = 1
+  spec.author        = 'Urabe, Shyouhei'
+  spec.email         = 'shyouhei@ruby-lang.org'
+  spec.summary       = 'provides crypt_checkpass / crypt_newhash'
+  spec.description   = <<-"end".gsub(/\s+/, ' ').strip
+    Check password hash, like OpenBSD's crypt_checkpass(3) / PHP's
+    password_verify()
+  end
+  spec.homepage      = 'https://github.com/shyouhei/crypt_checkpass'
+  spec.license       = 'MIT'
+  spec.files         = `git ls-files -z`.split("\x0").reject { |f|
+    f.match(%r'^(test|spec|features|samples)/')
+  }
+  spec.require_paths = %w'lib'
+
+  spec.add_development_dependency 'bundler'
+  spec.add_development_dependency 'pry-byebug'
+  spec.add_development_dependency 'rake'
+  spec.add_development_dependency 'rdoc'
+  spec.add_development_dependency 'redcarpet'
+  spec.add_development_dependency 'rubocop', '~> 0.49.0' # support for 2.0
+  spec.add_development_dependency 'simplecov'
+# spec.add_development_dependency 'stackprof' # needs ruby 2.1+
+  spec.add_development_dependency 'test-unit', '>= 3'
+  spec.add_development_dependency 'yard'
+  spec.required_ruby_version =    '>= 2.0.0'
+  spec.add_runtime_dependency     'consttime_memequal'
+end