Changed alternate login token from AES128-HMACSHA256 to AES256-HMACSHA384.
Ylian Saint-Hilaire committed
Dec 29, 2018 at 11:38 UTC
301587fdb12f95a28f5be789c9a967ba13897a0c
2 files changed
+16
-16
meshcentral.js
+15
-15
@@ -528,7 +528,7 @@ function CreateMeshCentralServer(config, args) {
528
// Load the login cookie encryption key from the database if allowed
529
if ((obj.config) && (obj.config.settings) && (obj.config.settings.allowlogintoken == true)) {
530
obj.db.Get('LoginCookieEncryptionKey', function (err, docs) {
531
- if ((docs.length > 0) && (docs[0].key != null) && (obj.args.logintokengen == null) && (docs[0].key.length >= 96)) {
531
+ if ((docs.length > 0) && (docs[0].key != null) && (obj.args.logintokengen == null) && (docs[0].key.length >= 160)) {
532
obj.loginCookieEncryptionKey = Buffer.from(docs[0].key, 'hex');
533
} else {
534
obj.loginCookieEncryptionKey = obj.generateCookieKey(); obj.db.Set({ _id: 'LoginCookieEncryptionKey', key: obj.loginCookieEncryptionKey.toString('hex'), time: Date.now() });
@@ -1067,7 +1067,7 @@ function CreateMeshCentralServer(config, args) {
1067
} else {
1068
// Load the login cookie encryption key from the database
1069
obj.db.Get('LoginCookieEncryptionKey', function (err, docs) {
1070
- if ((docs.length > 0) && (docs[0].key != null) && (obj.args.logintokengen == null) && (docs[0].key.length >= 96)) {
1070
+ if ((docs.length > 0) && (docs[0].key != null) && (obj.args.logintokengen == null) && (docs[0].key.length >= 160)) {
1071
// Key is present, use it.
1072
obj.loginCookieEncryptionKey = Buffer.from(docs[0].key, 'hex');
1073
func(obj.encodeCookie({ u: userid, a: 3 }, obj.loginCookieEncryptionKey));
@@ -1085,7 +1085,7 @@ function CreateMeshCentralServer(config, args) {
1085
obj.showLoginTokenKey = function (func) {
1086
// Load the login cookie encryption key from the database
1087
obj.db.Get('LoginCookieEncryptionKey', function (err, docs) {
1088
- if ((docs.length > 0) && (docs[0].key != null) && (obj.args.logintokengen == null) && (docs[0].key.length >= 96)) {
1088
+ if ((docs.length > 0) && (docs[0].key != null) && (obj.args.logintokengen == null) && (docs[0].key.length >= 160)) {
1089
// Key is present, use it.
1090
func(docs[0].key);
1091
} else {
@@ -1098,8 +1098,8 @@ function CreateMeshCentralServer(config, args) {
1098
1099
// Generate a cryptographic key used to encode and decode cookies
1100
obj.generateCookieKey = function () {
1101
- return new Buffer(obj.crypto.randomBytes(48), 'binary');
1102
- //return Buffer.alloc(48, 0); // Sets the key to zeros, debug only.
1101
+ return new Buffer(obj.crypto.randomBytes(80), 'binary');
1102
+ //return Buffer.alloc(80, 0); // Sets the key to zeros, debug only.
1103
};
1104
1105
// Encode an object as a cookie using a key using AES-GCM. (key must be 32 bytes or more)
@@ -1113,14 +1113,14 @@ function CreateMeshCentralServer(config, args) {
1113
} catch (e) { return null; }
1114
};
1115
1116
- // Decode a cookie back into an object using a key using AES-GCM or AES128-CBC/HMAC-SHA386. Return null if it's not a valid cookie. (key must be 32 bytes or more)
1116
+ // Decode a cookie back into an object using a key using AES256-GCM or AES128-CBC/HMAC-SHA386. Return null if it's not a valid cookie. (key must be 32 bytes or more)
1117
obj.decodeCookie = function (cookie, key, timeout) {
1118
const r = obj.decodeCookieAESGCM(cookie, key, timeout);
1119
if (r == null) { return obj.decodeCookieAESSHA(cookie, key, timeout); }
1120
return r;
1121
}
1122
1123
- // Decode a cookie back into an object using a key using AES-GCM. Return null if it's not a valid cookie. (key must be 32 bytes or more)
1123
+ // Decode a cookie back into an object using a key using AES256-GCM. Return null if it's not a valid cookie. (key must be 32 bytes or more)
1124
obj.decodeCookieAESGCM = function (cookie, key, timeout) {
1125
try {
1126
if (key == null) { key = obj.serverKey; }
@@ -1137,19 +1137,19 @@ function CreateMeshCentralServer(config, args) {
1137
} catch (e) { return null; }
1138
};
1139
1140
- // Decode a cookie back into an object using a key using AES128 / HMAC-SHA256. Return null if it's not a valid cookie. (key must be 48 bytes or more)
1141
- // We do this because poor .NET does not support AES-GCM.
1140
+ // Decode a cookie back into an object using a key using AES256 / HMAC-SHA386. Return null if it's not a valid cookie. (key must be 80 bytes or more)
1141
+ // We do this because poor .NET does not support AES256-GCM.
1142
obj.decodeCookieAESSHA = function (cookie, key, timeout) {
1143
try {
1144
if (key == null) { key = obj.serverKey; }
1145
- if (key.length < 48) return null;
1145
+ if (key.length < 80) { return null; }
1146
cookie = new Buffer(cookie.replace(/\@/g, '+').replace(/\$/g, '/'), 'base64');
1147
- const decipher = obj.crypto.createDecipheriv('aes-128-cbc', key.slice(32, 48), cookie.slice(0, 16));
1147
+ const decipher = obj.crypto.createDecipheriv('aes-256-cbc', key.slice(48, 80), cookie.slice(0, 16));
1148
const rawmsg = decipher.update(cookie.slice(16), 'binary', 'binary') + decipher.final('binary');
1149
- const hmac = obj.crypto.createHmac('sha256', key.slice(0, 32));
1150
- hmac.update(rawmsg.slice(32));
1151
- if (Buffer.compare(hmac.digest(), Buffer.from(rawmsg.slice(0, 32))) == false) { return null; }
1152
- const o = JSON.parse(rawmsg.slice(32).toString('utf8'));
1149
+ const hmac = obj.crypto.createHmac('sha384', key.slice(0, 48));
1150
+ hmac.update(rawmsg.slice(48));
1151
+ if (Buffer.compare(hmac.digest(), Buffer.from(rawmsg.slice(0, 48))) == false) { return null; }
1152
+ const o = JSON.parse(rawmsg.slice(48).toString('utf8'));
1153
if ((o.time == null) || (o.time == null) || (typeof o.time != 'number')) { Debug(1, 'ERR: Bad cookie due to invalid time'); return null; }
1154
o.time = o.time * 1000; // Decode the cookie creation time
1155
o.dtime = Date.now() - o.time; // Decode how long ago the cookie was created (in milliseconds)
package.json
+1
-1
@@ -1,6 +1,6 @@
1
{
2
"name": "meshcentral",
3
- "version": "0.2.5-f",
3
+ "version": "0.2.5-g",
4
"keywords": [
5
"Remote Management",
6
"Intel AMT",