passwordping 1.0.1 → 1.0.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 31d4b9fb4475b1fabca8031eea2650e53f4c0102
-  data.tar.gz: 724759e58a8f0c95a3fb9cd7d57b7188d0d1335f
+  metadata.gz: 4700c7b670bd2e343c643e3e5f64a2d7c8880cae
+  data.tar.gz: 228089e6bb3fad5d660c71f10adb4cec2a109408
 SHA512:
-  metadata.gz: 6e71c6c80d4284d94c6865ddccf7163ada73f7e8a5bf98bbb0e4bd30c786f7ad70bd9fb13245624ab26436d1aa798086540599d2a8faf25fab7fee4c5fa37886
-  data.tar.gz: e3c9ec3cefc0de5bf8d2cc68a6b39c3ee13334559d1c9134a2a000df1e0993c5da0058c783042d672895b69e0c9201fe412f15b55dadc4754decb4f1229705fa
+  metadata.gz: c2b2c0cce6c5f209a3b9ddcceffd7d76a1dc2747a51f7eb6752e942719bdac7dfdd0c30e4aaff02c799c7df1c02276679395497d63a148a82e74fd50b40d7ab8
+  data.tar.gz: f3638fba98a5612b627495a616e90b21aafd732905917f129b4cfe2a0fe07b7bf6f385960538d2f9959cfc024b9fe1de8e57b6477d8fdfd17c83311dfcc14322

data/.gitignore

@@ -14,3 +14,4 @@
 /ext/argon2-wrapper/tests
 /ext/argon2-wrapper/libargon2-wrapper.bundle*
 passwordping-1.0.0.gem
+*.bundle

data/lib/passwordping.rb

@@ -123,10 +123,7 @@ module PasswordPing
         password_hash = calc_password_hash(hash_spec["hashType"], password, hash_spec["salt"])
 
         if (password_hash != nil)
-          argon2_hash = Hashing.argon2(username + "$" + password_hash, salt)
-
-          just_hash = argon2_hash[argon2_hash.rindex('$') + 1 .. argon2_hash.length]
-          return Base64.decode64(just_hash).unpack('H*')[0]
+          return Hashing.argon2_raw(username + "$" + password_hash, salt)
         else
           return nil
         end

data/lib/passwordping/hashing.rb

@@ -4,7 +4,7 @@ require 'bcrypt'
 require 'unix_crypt'
 require 'zlib'
 require 'digest/whirlpool'
-require 'base64'
+require 'base64url'
 
 module PasswordPing
   class Hashing
@@ -155,6 +155,47 @@ module PasswordPing
       return self.bcrypt(self.md5(to_hash), salt)
     end
 
+    def self.argon2_raw(to_hash, salt)
+      time_cost = 3
+      mem_cost = 10
+      threads = 2
+      hash_length = 20
+      just_salt = salt
+
+      #$argon2i$v=19$m=65536,t=2,p=4$c29tZXNhbHQ$RdescudvJCsgt3ub+b+dWRWJTmaaJObG
+      if (salt[0..6] == "$argon2")
+        # looks like we specified algo info for argon2 in the salt
+        salt_values = salt.split("$")
+        just_salt = Base64URL.decode(salt_values[4])
+        cost_params = salt_values[3].split(",")
+
+        for param in cost_params
+          begin
+            param_parts = param.split("=")
+            if (param_parts[0] == "t")
+              time_cost = Integer(param_parts[1])
+            elsif (param_parts[0] == "m")
+              mem_cost = Math.log2(Integer(param_parts[1])).round
+            elsif (param_parts[0] == "p")
+              threads = Integer(param_parts[1])
+            elsif (param_parts[0] == "l")
+              hash_length = Integer(param_parts[1])
+            end
+          rescue ArgumentError
+            # ignore invalid params and just use default
+          end
+        end
+
+        if (salt_values[1] == "argon2i")
+          return Argon2Wrapper.hash_argon2i(to_hash, just_salt, time_cost, mem_cost, threads, hash_length)
+        else
+          return Argon2Wrapper.hash_argon2d(to_hash, just_salt, time_cost, mem_cost, threads, hash_length)
+        end
+      else
+        return Argon2Wrapper.hash_argon2d(to_hash, just_salt, time_cost, mem_cost, threads, hash_length)
+      end
+    end
+
     def self.argon2(to_hash, salt)
       time_cost = 3
       mem_cost = 10
@@ -166,7 +207,7 @@ module PasswordPing
       if (salt[0..6] == "$argon2")
         # looks like we specified algo info for argon2 in the salt
         salt_values = salt.split("$")
-        just_salt = Base64.decode64(salt_values[4])
+        just_salt = Base64URL.decode(salt_values[4])
         cost_params = salt_values[3].split(",")
 
         for param in cost_params

data/lib/passwordping/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 # Standard Gem version constant.
 module PasswordPing
-  VERSION = "1.0.1".freeze
+  VERSION = "1.0.2".freeze
 end

data/passwordping.gemspec

@@ -25,10 +25,12 @@ Gem::Specification.new do |spec|
   spec.add_dependency 'rest-client', '~> 2.0', '>= 2.0.2'
   spec.add_dependency 'bcrypt', '~> 3.1', '>= 3.1.11'
   spec.add_dependency 'unix-crypt', '~> 1.3'
+  spec.add_dependency 'base64url', '~> 1.0', '>= 1.0.1'
 
   spec.add_development_dependency "bundler", '~> 1.10', '>= 1.10.5'
   spec.add_development_dependency "rake", '~> 10.4', '>= 10.4.2'
   spec.add_development_dependency "test-unit", '~> 3.2', '>= 3.2.4'
   spec.add_development_dependency "rake-compiler", '~> 1.0', '>= 1.0.4'
+  spec.add_development_dependency "io-console", '~> 0.4', '>= 0.4.6'
   spec.extensions = ['ext/argon2-wrapper/extconf.rb', "ext/digest/whirlpool/extconf.rb" ]
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: passwordping
 version: !ruby/object:Gem::Version
-  version: 1.0.1
+  version: 1.0.2
 platform: ruby
 authors:
 - PasswordPing
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2017-06-08 00:00:00.000000000 Z
+date: 2017-06-09 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: ffi
@@ -92,6 +92,26 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '1.3'
+- !ruby/object:Gem::Dependency
+  name: base64url
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.0'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 1.0.1
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.0'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 1.0.1
 - !ruby/object:Gem::Dependency
   name: bundler
   requirement: !ruby/object:Gem::Requirement
@@ -172,6 +192,26 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: 1.0.4
+- !ruby/object:Gem::Dependency
+  name: io-console
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.4'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 0.4.6
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.4'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 0.4.6
 description: Ruby library for PasswordPing API
 email:
 - support@passwordping.com
@@ -276,7 +316,6 @@ files:
 - ext/phc-winner-argon2/vs2015/Argon2RefGenKAT/Argon2RefGenKAT.vcxproj.filters
 - ext/phc-winner-argon2/vs2015/Argon2RefTestCI/Argon2RefTestCI.vcxproj
 - ext/phc-winner-argon2/vs2015/Argon2RefTestCI/Argon2RefTestCI.vcxproj.filters
-- lib/digest/whirlpool.bundle
 - lib/passwordping.rb
 - lib/passwordping/argon2_wrapper_ffi.rb
 - lib/passwordping/constants.rb