jeirmeister/Cockatrice
1
0
Fork 0
mirror of https://github.com/Cockatrice/Cockatrice.git synced 2026-09-21 09:05:10 -07:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

[Security] Use a CSPRNG for salts, tokens, and RNG seeding

Browse source 
Password salts and activation tokens were generated with the global SFMT
RNG, which was seeded from a 32-bit timestamp, making registration
salts and activation tokens predictable. The game RNG used the same
timestamp seed across restarts.

Add CryptoUtil backed by OpenSSL RAND_bytes and use it for salt/token
generation and to seed RNG_SFMT with a 64-bit CSPRNG value in both the
client and server. Link libcockatrice_utility against OpenSSL::Crypto.

Took 30 seconds
This commit is contained in:
Lukas Brübach 2026-08-04 10:02:35 +02:00
parent bfdb9b0f1d
commit b142221e62
9 changed files with 100 additions and 26 deletions
Download patch file Download diff file Expand all files Collapse all files

41
tests/password_hash_test.cpp
View file

@ -1,25 +1,9 @@
#include "gtest/gtest.h"
#include <libcockatrice/rng/rng_abstract.h>
#include <libcockatrice/rng/rng_sfmt.h>
#include <cstring>
#include <libcockatrice/utility/passwordhasher.h>
RNG_Abstract *rng;
namespace
{
class PasswordHashTest : public ::testing::Test
{
protected:
void SetUp() override
{
rng = new RNG_SFMT;
}
void TearDown() override
{
delete rng;
}
};
TEST(PasswordHashTest, RegressionTest)
{
@ -29,6 +13,29 @@ TEST(PasswordHashTest, RegressionTest)
QString hash = PasswordHasher::computeHash(password, salt);
ASSERT_EQ(hash, salt + expected) << "The computed hash value remains the same";
}
TEST(PasswordHashTest, SaltUsesAlphanumericCharset)
{
static const char alphanum[] = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
const QString salt = PasswordHasher::generateRandomSalt();
ASSERT_EQ(salt.size(), 16);
for (const QChar &c : salt) {
ASSERT_NE(strchr(alphanum, c.toLatin1()), nullptr);
}
}
TEST(PasswordHashTest, SaltsAreUnique)
{
const QString salt1 = PasswordHasher::generateRandomSalt();
const QString salt2 = PasswordHasher::generateRandomSalt();
ASSERT_NE(salt1, salt2);
}
TEST(PasswordHashTest, TokenHasExpectedLength)
{
const QString token = PasswordHasher::generateActivationToken();
ASSERT_EQ(token.size(), 16);
}
} // namespace
int main(int argc, char **argv)