Line data    Source code

       1              : //! Tools for SCRAM server secret management.
       2              : 
       3              : use subtle::{Choice, ConstantTimeEq};
       4              : 
       5              : use super::base64_decode_array;
       6              : use super::key::ScramKey;
       7              : 
       8              : /// Server secret is produced from user's password,
       9              : /// and is used throughout the authentication process.
      10              : #[derive(Clone, Eq, PartialEq, Debug)]
      11              : pub(crate) struct ServerSecret {
      12              :     /// Number of iterations for `PBKDF2` function.
      13              :     pub(crate) iterations: u32,
      14              :     /// Salt used to hash user's password.
      15              :     pub(crate) salt_base64: String,
      16              :     /// Hashed `ClientKey`.
      17              :     pub(crate) stored_key: ScramKey,
      18              :     /// Used by client to verify server's signature.
      19              :     pub(crate) server_key: ScramKey,
      20              :     /// Should auth fail no matter what?
      21              :     /// This is exactly the case for mocked secrets.
      22              :     pub(crate) doomed: bool,
      23              : }
      24              : 
      25              : impl ServerSecret {
      26          108 :     pub(crate) fn parse(input: &str) -> Option<Self> {
      27              :         // SCRAM-SHA-256$<iterations>:<salt>$<storedkey>:<serverkey>
      28          108 :         let s = input.strip_prefix("SCRAM-SHA-256$")?;
      29          108 :         let (params, keys) = s.split_once('$')?;
      30              : 
      31          108 :         let ((iterations, salt), (stored_key, server_key)) =
      32          108 :             params.split_once(':').zip(keys.split_once(':'))?;
      33              : 
      34          108 :         let secret = ServerSecret {
      35          108 :             iterations: iterations.parse().ok()?,
      36          108 :             salt_base64: salt.to_owned(),
      37          108 :             stored_key: base64_decode_array(stored_key)?.into(),
      38          108 :             server_key: base64_decode_array(server_key)?.into(),
      39          108 :             doomed: false,
      40          108 :         };
      41          108 : 
      42          108 :         Some(secret)
      43          108 :     }
      44              : 
      45           72 :     pub(crate) fn is_password_invalid(&self, client_key: &ScramKey) -> Choice {
      46           72 :         // constant time to not leak partial key match
      47           72 :         client_key.sha256().ct_ne(&self.stored_key) | Choice::from(self.doomed as u8)
      48           72 :     }
      49              : 
      50              :     /// To avoid revealing information to an attacker, we use a
      51              :     /// mocked server secret even if the user doesn't exist.
      52              :     /// See `auth-scram.c : mock_scram_secret` for details.
      53           42 :     pub(crate) fn mock(nonce: [u8; 32]) -> Self {
      54           42 :         Self {
      55           42 :             // this doesn't reveal much information as we're going to use
      56           42 :             // iteration count 1 for our generated passwords going forward.
      57           42 :             // PG16 users can set iteration count=1 already today.
      58           42 :             iterations: 1,
      59           42 :             salt_base64: base64::encode(nonce),
      60           42 :             stored_key: ScramKey::default(),
      61           42 :             server_key: ScramKey::default(),
      62           42 :             doomed: true,
      63           42 :         }
      64           42 :     }
      65              : 
      66              :     /// Build a new server secret from the prerequisites.
      67              :     /// XXX: We only use this function in tests.
      68              :     #[cfg(test)]
      69           96 :     pub(crate) async fn build(password: &str) -> Option<Self> {
      70          288 :         Self::parse(&postgres_protocol::password::scram_sha_256(password.as_bytes()).await)
      71           96 :     }
      72              : }
      73              : 
      74              : #[cfg(test)]
      75              : mod tests {
      76              :     use super::*;
      77              : 
      78              :     #[test]
      79            6 :     fn parse_scram_secret() {
      80            6 :         let iterations = 4096;
      81            6 :         let salt = "+/tQQax7twvwTj64mjBsxQ==";
      82            6 :         let stored_key = "D5h6KTMBlUvDJk2Y8ELfC1Sjtc6k9YHjRyuRZyBNJns=";
      83            6 :         let server_key = "Pi3QHbcluX//NDfVkKlFl88GGzlJ5LkyPwcdlN/QBvI=";
      84            6 : 
      85            6 :         let secret = format!("SCRAM-SHA-256${iterations}:{salt}${stored_key}:{server_key}");
      86            6 : 
      87            6 :         let parsed = ServerSecret::parse(&secret).unwrap();
      88            6 :         assert_eq!(parsed.iterations, iterations);
      89            6 :         assert_eq!(parsed.salt_base64, salt);
      90              : 
      91            6 :         assert_eq!(base64::encode(parsed.stored_key), stored_key);
      92            6 :         assert_eq!(base64::encode(parsed.server_key), server_key);
      93            6 :     }
      94              : }