Ryan Tandy authored 4 years ago and Quanah Gibson-Mount committed 4 years ago

The defaults vary by crypto library and possibly even version, so it's
not worth trying to keep them accurate.

Peter Marschall authored 4 years ago and Quanah Gibson-Mount committed 4 years ago

* use 'crypto_pwhash_str_alg(..., crypto_pwhash_ALG_ARGON2ID13)' to set
  the algorithm to Argon2.
  According to libsodium's documentation, the original 'crypto_pwhash_str()'
  only guarantees a "memory-hard, CPU-intensive hash function", but not
  necessarily Argon2.  Although in released versions of libsodium Argon2 is
  the only implemented backend, this may chane in the future.
* multiply the 'memory' parameter by 1024 to align it with the libargon2
  implementation. The objective is to have consistent configuration in
  OpenLDAP's pw-argon2 module no matter what backend implementation is used.

Signed-off-by: Peter Marschall <peter@adpm.de>

Ryan Tandy authored 4 years ago and Quanah Gibson-Mount committed 4 years ago

Based on initial patch by Peter Marschall.

Peter Marschall authored 4 years ago and Quanah Gibson-Mount committed 4 years ago

Add manual page slapd-pw-argon2.5 and make sure it gets installed.

Signed-off-by: Peter Marschall <peter@adpm.de>

Simon Levermann authored 8 years ago and Quanah Gibson-Mount committed 4 years ago

This change implements argon2, which won the Password Hashing
Competition (https://password-hashing.net/) as a contrib-module in order
to provide a modern password hashing alternative in openldap. The
currently available password hashing algorithms are relatively old, and
modern hardware, especially GPUs can compute quite a few (ranging from
tens of thousands to millions) of hashes per second. Argon2 was designed
to withstand such attacks.

This implementation uses the default work factors used in the argon2
command line client, but the resulting hashes are stored in a way that
would allow retroactive changes to these values, or even exposing them
as configuration in the module.

Devin J. Pohly authored 14 years ago and Quanah Gibson-Mount committed 8 years ago

These were provided as part of the original ITS but not previously committed.
Perl scripts to convert between Apache and OpenLDAP hash formats.

Ryan Tandy authored 9 years ago and Quanah Gibson-Mount committed 9 years ago

Reserve #else for actual fallback cases.

Luca Bruno authored 10 years ago and Quanah Gibson-Mount committed 9 years ago

OpenLDAP can be configured to be either built with OpenSSL or
GnuTLS. This commit adds support for building pw-pbkbdf2 module
without OpenSSL, by using PBKDF2 crypto primitives provided by
libnettle.
Closes hamano/openldap-pbkdf2#2

Signed-off-by: Luca Bruno <luca.bruno@rocket-internet.de>

Luca Bruno authored 10 years ago and Quanah Gibson-Mount committed 9 years ago

Fixed asprintf return value check, in order to properly catch
error conditions. This has been caught by clang -Wtautological-compare:

pw-pbkdf2.c:132:17: warning: comparison of unsigned expression < 0 is always false
        if(msg->bv_len < 0){
           ~~~~~~~~~~~ ^ ~

Signed-off-by: Luca Bruno <luca.bruno@rocket-internet.de>

SATOH Fumiyasu authored 11 years ago and Quanah Gibson-Mount committed 10 years ago

Set LDAP_BUILD=$(LDAP_SRC) by default

Ryan Tandy authored 10 years ago and Quanah Gibson-Mount committed 10 years ago

Similar to #7858, another easy patch.

HAMANO Tsukasa authored 11 years ago and Quanah Gibson-Mount committed 10 years ago

Signed-off-by: HAMANO Tsukasa <hamano@osstech.co.jp>

Zero out the complete context buffer
From mhardin@symas.com

SATOH Fumiyasu authored 12 years ago and Quanah Gibson-Mount committed 12 years ago

Support {SSHA256}, {SSHA384} and {SSHA512} hash schemes

SATOH Fumiyasu authored 12 years ago and Quanah Gibson-Mount committed 12 years ago

Remove sha*_hex_hash() and replace chk_sha*() with
libraries/liblutil/passwd.c:chk_sha1() implementation to
avoid a race condition.

SATOH Fumiyasu authored 12 years ago and Quanah Gibson-Mount committed 12 years ago

contrib/slapd-modules/passwd/sha2/sha2.[ch] need portable.h and
some macros to be portable source.

contrib/slapd-modules/passwd/sha2/slapd-sha2.c:hash_sha*() must
declare "struct berval digest" before a statement for K&R C,
and must replace C++ "// foo"-style comments with C style.