diff options
| -rw-r--r-- | apps/encryption/lib/Crypto/Crypt.php | 18 | ||||
| -rw-r--r-- | apps/encryption/tests/Crypto/CryptTest.php | 2 |
2 files changed, 10 insertions, 10 deletions
diff --git a/apps/encryption/lib/Crypto/Crypt.php b/apps/encryption/lib/Crypto/Crypt.php index 0cf6451d287..cd2453e8c70 100644 --- a/apps/encryption/lib/Crypto/Crypt.php +++ b/apps/encryption/lib/Crypto/Crypt.php @@ -70,9 +70,9 @@ class Crypt { // default cipher from old Nextcloud versions public const LEGACY_CIPHER = 'AES-128-CFB'; - public const SUPPORTED_KEY_FORMATS = ['hash', 'password']; + public const SUPPORTED_KEY_FORMATS = ['hash2', 'hash', 'password']; // one out of SUPPORTED_KEY_FORMATS - public const DEFAULT_KEY_FORMAT = 'hash'; + public const DEFAULT_KEY_FORMAT = 'hash2'; // default key format, old Nextcloud version encrypted the private key directly // with the user password public const LEGACY_KEY_FORMAT = 'password'; @@ -371,22 +371,20 @@ class Crypt { * @param string $uid only used for user keys * @return string */ - protected function generatePasswordHash($password, $cipher, $uid = '') { + protected function generatePasswordHash(string $password, string $cipher, string $uid = '', int $iterations = 600000): string { $instanceId = $this->config->getSystemValue('instanceid'); $instanceSecret = $this->config->getSystemValue('secret'); $salt = hash('sha256', $uid . $instanceId . $instanceSecret, true); $keySize = $this->getKeySize($cipher); - $hash = hash_pbkdf2( + return hash_pbkdf2( 'sha256', $password, $salt, - 100000, + $iterations, $keySize, true ); - - return $hash; } /** @@ -431,8 +429,10 @@ class Crypt { $keyFormat = self::LEGACY_KEY_FORMAT; } - if ($keyFormat === self::DEFAULT_KEY_FORMAT) { - $password = $this->generatePasswordHash($password, $cipher, $uid); + if ($keyFormat === 'hash') { + $password = $this->generatePasswordHash($password, $cipher, $uid, 100000); + } elseif ($keyFormat === 'hash2') { + $password = $this->generatePasswordHash($password, $cipher, $uid, 600000); } $binaryEncoding = isset($header['encoding']) && $header['encoding'] === self::BINARY_ENCODING_FORMAT; diff --git a/apps/encryption/tests/Crypto/CryptTest.php b/apps/encryption/tests/Crypto/CryptTest.php index dd41c67e8ad..0bb2c652d8b 100644 --- a/apps/encryption/tests/Crypto/CryptTest.php +++ b/apps/encryption/tests/Crypto/CryptTest.php @@ -137,7 +137,7 @@ class CryptTest extends TestCase { */ public function dataTestGenerateHeader() { return [ - [null, 'HBEGIN:cipher:AES-128-CFB:keyFormat:hash:encoding:binary:HEND'], + [null, 'HBEGIN:cipher:AES-128-CFB:keyFormat:hash2:encoding:binary:HEND'], ['password', 'HBEGIN:cipher:AES-128-CFB:keyFormat:password:encoding:binary:HEND'], ['hash', 'HBEGIN:cipher:AES-128-CFB:keyFormat:hash:encoding:binary:HEND'] ]; |