fedserv/echo
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Derive registration credentials off-thread; rate-limit REGISTER; constant-time SCRAM compare

Browse source
This commit is contained in:
Jean Chevronnet 2026-07-12 02:31:52 +00:00
parent 496c0f99a6
commit 9a918839fe
No known key found for this signature in database
10 changed files with 214 additions and 36 deletions
Download patch file Download diff file Expand all files Collapse all files

4
src/engine/scram.rs
View file

@ -13,6 +13,7 @@ use argon2::password_hash::rand_core::{OsRng, RngCore};
use base64::{engine::general_purpose::STANDARD, Engine as _};
use hmac::{Hmac, Mac};
use sha2::{Digest, Sha256, Sha512};
use subtle::ConstantTimeEq;
// Provisioning cost. High on purpose: the client bears the Hi() work each login,
// the server only at REGISTER, and the verifier must not be a weaker
@ -227,7 +228,8 @@ pub fn verify_final(
return None;
}
let client_key = xor(&proof, &client_signature);
if h(hash, &client_key) != v.stored_key {
// Constant-time: StoredKey is a secret, so leak nothing through compare timing.
if h(hash, &client_key).ct_eq(&v.stored_key).unwrap_u8() != 1 {
return None;
}
let server_signature = hmac(hash, &v.server_key, auth_message.as_bytes());