| | | 1 | | using System; |
| | | 2 | | using System.Collections.Generic; |
| | | 3 | | using System.Globalization; |
| | | 4 | | using System.Security.Cryptography; |
| | | 5 | | using MediaBrowser.Model.Cryptography; |
| | | 6 | | using static MediaBrowser.Model.Cryptography.Constants; |
| | | 7 | | |
| | | 8 | | namespace Emby.Server.Implementations.Cryptography |
| | | 9 | | { |
| | | 10 | | /// <summary> |
| | | 11 | | /// Class providing abstractions over cryptographic functions. |
| | | 12 | | /// </summary> |
| | | 13 | | public class CryptographyProvider : ICryptoProvider |
| | | 14 | | { |
| | | 15 | | /// <inheritdoc /> |
| | 5 | 16 | | public string DefaultHashMethod => "PBKDF2-SHA512"; |
| | | 17 | | |
| | | 18 | | /// <inheritdoc /> |
| | | 19 | | public PasswordHash CreatePasswordHash(ReadOnlySpan<char> password) |
| | | 20 | | { |
| | 5 | 21 | | byte[] salt = GenerateSalt(); |
| | 5 | 22 | | return new PasswordHash( |
| | 5 | 23 | | DefaultHashMethod, |
| | 5 | 24 | | Rfc2898DeriveBytes.Pbkdf2( |
| | 5 | 25 | | password, |
| | 5 | 26 | | salt, |
| | 5 | 27 | | DefaultIterations, |
| | 5 | 28 | | HashAlgorithmName.SHA512, |
| | 5 | 29 | | DefaultOutputLength), |
| | 5 | 30 | | salt, |
| | 5 | 31 | | new Dictionary<string, string> |
| | 5 | 32 | | { |
| | 5 | 33 | | { "iterations", DefaultIterations.ToString(CultureInfo.InvariantCulture) } |
| | 5 | 34 | | }); |
| | | 35 | | } |
| | | 36 | | |
| | | 37 | | /// <inheritdoc /> |
| | | 38 | | public bool Verify(PasswordHash hash, ReadOnlySpan<char> password) |
| | | 39 | | { |
| | 7 | 40 | | if (string.Equals(hash.Id, "PBKDF2", StringComparison.Ordinal)) |
| | | 41 | | { |
| | 2 | 42 | | var iterations = GetIterationsParameter(hash); |
| | 0 | 43 | | return hash.Hash.SequenceEqual( |
| | 0 | 44 | | Rfc2898DeriveBytes.Pbkdf2( |
| | 0 | 45 | | password, |
| | 0 | 46 | | hash.Salt, |
| | 0 | 47 | | iterations, |
| | 0 | 48 | | HashAlgorithmName.SHA1, |
| | 0 | 49 | | 32)); |
| | | 50 | | } |
| | | 51 | | |
| | 5 | 52 | | if (string.Equals(hash.Id, "PBKDF2-SHA512", StringComparison.Ordinal)) |
| | | 53 | | { |
| | 4 | 54 | | var iterations = GetIterationsParameter(hash); |
| | 2 | 55 | | return hash.Hash.SequenceEqual( |
| | 2 | 56 | | Rfc2898DeriveBytes.Pbkdf2( |
| | 2 | 57 | | password, |
| | 2 | 58 | | hash.Salt, |
| | 2 | 59 | | iterations, |
| | 2 | 60 | | HashAlgorithmName.SHA512, |
| | 2 | 61 | | DefaultOutputLength)); |
| | | 62 | | } |
| | | 63 | | |
| | 1 | 64 | | throw new NotSupportedException($"Can't verify hash with id: {hash.Id}"); |
| | | 65 | | } |
| | | 66 | | |
| | | 67 | | /// <summary> |
| | | 68 | | /// Extracts and validates the iterations parameter from a password hash. |
| | | 69 | | /// </summary> |
| | | 70 | | /// <param name="hash">The password hash containing parameters.</param> |
| | | 71 | | /// <returns>The number of iterations.</returns> |
| | | 72 | | /// <exception cref="FormatException">Thrown when iterations parameter is missing or invalid.</exception> |
| | | 73 | | private static int GetIterationsParameter(PasswordHash hash) |
| | | 74 | | { |
| | 6 | 75 | | if (!hash.Parameters.TryGetValue("iterations", out var iterationsStr)) |
| | | 76 | | { |
| | 2 | 77 | | throw new FormatException($"Password hash with id '{hash.Id}' is missing required 'iterations' parameter |
| | | 78 | | } |
| | | 79 | | |
| | 4 | 80 | | if (!int.TryParse(iterationsStr, CultureInfo.InvariantCulture, out var iterations)) |
| | | 81 | | { |
| | 2 | 82 | | throw new FormatException($"Password hash with id '{hash.Id}' has invalid 'iterations' parameter: '{iter |
| | | 83 | | } |
| | | 84 | | |
| | 2 | 85 | | return iterations; |
| | | 86 | | } |
| | | 87 | | |
| | | 88 | | /// <inheritdoc /> |
| | | 89 | | public byte[] GenerateSalt() |
| | 6 | 90 | | => GenerateSalt(DefaultSaltLength); |
| | | 91 | | |
| | | 92 | | /// <inheritdoc /> |
| | | 93 | | public byte[] GenerateSalt(int length) |
| | | 94 | | { |
| | 9 | 95 | | var salt = new byte[length]; |
| | 9 | 96 | | using var rng = RandomNumberGenerator.Create(); |
| | 9 | 97 | | rng.GetNonZeroBytes(salt); |
| | 9 | 98 | | return salt; |
| | 9 | 99 | | } |
| | | 100 | | } |
| | | 101 | | } |