shimun/fido2luks
1
0
Fork 0
Code Issues Pull Requests 3 Releases Wiki Activity

Use ring for sha256 calculation

Browse Source 
According to https://rustsec.org/advisories/RUSTSEC-2016-0005.html,
rust-crypto is unmaintained.

Crates depending on rust-crypto should be ported to other crates.

This port replaces rust-crypto with the sha2 implementation of ring,
as fido2luks already depends on it via ctap_hmac. Note that it uses
an old version of ring, so I used the same version, here.
This commit is contained in:
Jan Niehusmann 2019-10-11 21:52:35 +00:00
parent 79e9a37806
commit 3cf5ccf2a0
4 changed files with 13 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
Cargo.lock generated
View File

@ -180,8 +180,8 @@ dependencies = [
"failure 0.1.5 (registry+https://github.com/rust-lang/crates.io-index)", "failure 0.1.5 (registry+https://github.com/rust-lang/crates.io-index)",
"hex 0.3.2 (registry+https://github.com/rust-lang/crates.io-index)", "hex 0.3.2 (registry+https://github.com/rust-lang/crates.io-index)",
"libcryptsetup-sys 0.1.2 (registry+https://github.com/rust-lang/crates.io-index)", "libcryptsetup-sys 0.1.2 (registry+https://github.com/rust-lang/crates.io-index)",
"ring 0.13.5 (registry+https://github.com/rust-lang/crates.io-index)",
"rpassword 4.0.1 (registry+https://github.com/rust-lang/crates.io-index)", "rpassword 4.0.1 (registry+https://github.com/rust-lang/crates.io-index)",
"rust-crypto 0.2.36 (registry+https://github.com/rust-lang/crates.io-index)",
"structopt 0.3.2 (registry+https://github.com/rust-lang/crates.io-index)", "structopt 0.3.2 (registry+https://github.com/rust-lang/crates.io-index)",
] ]

2
Cargo.toml
View File

@ -21,7 +21,7 @@ libcryptsetup-sys = "0.1.2"
hex = "0.3.2" hex = "0.3.2"
rust-crypto = "0.2.36" ring = "0.13.5"
failure = "0.1.5" failure = "0.1.5"
rpassword = "4.0.1" rpassword = "4.0.1"
structopt = "0.3.2" structopt = "0.3.2"

13
src/config.rs
View File

@ -1,7 +1,6 @@
use crate::error::*; use crate::error::*;
use crate::*; use crate::*;
use crypto::digest::Digest; use ring::digest;
use crypto::sha2::Sha256;
use std::fmt; use std::fmt;
use std::fs::File; use std::fs::File;
@ -57,7 +56,7 @@ impl fmt::Display for InputSalt {
impl InputSalt { impl InputSalt {
pub fn obtain(&self, password_helper: &PasswordHelper) -> Fido2LuksResult<[u8; 32]> { pub fn obtain(&self, password_helper: &PasswordHelper) -> Fido2LuksResult<[u8; 32]> {
let mut digest = Sha256::new(); let mut digest = digest::Context::new(&digest::SHA256);
match self { match self {
InputSalt::File { path } => { InputSalt::File { path } => {
let mut do_io = || { let mut do_io = || {
@ -65,7 +64,7 @@ impl InputSalt {
let mut buf = [0u8; 512]; let mut buf = [0u8; 512];
loop { loop {
let red = reader.read(&mut buf)?; let red = reader.read(&mut buf)?;
digest.input(&buf[0..red]); digest.update(&buf[0..red]);
if red == 0 { if red == 0 {
break; break;
} }
@ -75,12 +74,12 @@ impl InputSalt {
do_io().map_err(|cause| Fido2LuksError::KeyfileError { cause })?; do_io().map_err(|cause| Fido2LuksError::KeyfileError { cause })?;
} }
InputSalt::AskPassword => { InputSalt::AskPassword => {
digest.input(password_helper.obtain()?.as_bytes()); digest.update(password_helper.obtain()?.as_bytes());
} }
InputSalt::String(s) => digest.input(s.as_bytes()), InputSalt::String(s) => digest.update(s.as_bytes()),
} }
let mut salt = [0u8; 32]; let mut salt = [0u8; 32];
digest.result(&mut salt); salt.as_mut().copy_from_slice(digest.finish().as_ref());
Ok(salt) Ok(salt)
} }
} }

11
src/main.rs
View File

@ -5,10 +5,9 @@ use crate::cli::*;
use crate::config::*; use crate::config::*;
use crate::device::*; use crate::device::*;
use crate::error::*; use crate::error::*;
use crypto::digest::Digest;
use crypto::sha2::Sha256;
use cryptsetup_rs as luks; use cryptsetup_rs as luks;
use cryptsetup_rs::Luks1CryptDevice; use cryptsetup_rs::Luks1CryptDevice;
use ring::digest;
use std::io::{self}; use std::io::{self};
use std::path::PathBuf; use std::path::PathBuf;
@ -26,11 +25,11 @@ fn open_container(device: &PathBuf, name: &str, secret: &[u8; 32]) -> Fido2LuksR
} }
fn assemble_secret(hmac_result: &[u8], salt: &[u8]) -> [u8; 32] { fn assemble_secret(hmac_result: &[u8], salt: &[u8]) -> [u8; 32] {
let mut digest = Sha256::new(); let mut digest = digest::Context::new(&digest::SHA256);
digest.input(salt); digest.update(salt);
digest.input(hmac_result); digest.update(hmac_result);
let mut secret = [0u8; 32]; let mut secret = [0u8; 32];
digest.result(&mut secret); secret.as_mut().copy_from_slice(digest.finish().as_ref());
secret secret
} }