BugTrack/2469 OpenLDAP SHA-2 Support on password (patched by henoheno)

Supported SHA-2 password schemes:
* SHA256, SHA384, SHA512 (LDAP: OpenLDAP compatible)
* SSHA256, SSHA384, SSHA512 (OpenLDAP compatible - Salted version)
* x-php-sha256, x-php-sha384, x-php-512 (Simple hex version)

RFC 6234: US Secure Hash Algorithms (SHA and SHA-based HMAC and HKDF)
https://tools.ietf.org/html/rfc6234

Internet-Draft: Lightweight Directory Access Protocol (LDAP): Hashed Attribute values for 'userPassword' (March 13, 2013)
https://tools.ietf.org/html/draft-stroeder-hashed-userpassword-values-01

diff --git a/lib/auth.php b/lib/auth.php
index f6d1a11..0753105 100644 (file)
--- a/lib/auth.php
+++ b/lib/auth.php
@@ -85,6 +85,12 @@ function pkwk_hash_compute($phrase = '', $scheme = '{x-php-md5}', $prefix = TRUE
                        hash('sha256', $phrase);
                break;
 
+       // PHP sha384
+       case '{x-php-sha384}'  :
+               $hash = ($prefix ? ($canonical ? '{x-php-sha384}' : $scheme) : '') .
+                       hash('sha384', $phrase);
+               break;
+
        // PHP sha512
        case '{x-php-sha512}'  :
                $hash = ($prefix ? ($canonical ? '{x-php-sha512}' : $scheme) : '') .
@@ -125,6 +131,48 @@ function pkwk_hash_compute($phrase = '', $scheme = '{x-php-md5}', $prefix = TRUE
                        base64_encode(pkwk_hex2bin(sha1($phrase . $salt)) . $salt);
                break;
 
+       // LDAP SHA256
+       case '{sha256}'        :
+               $hash = ($prefix ? ($canonical ? '{SHA256}' : $scheme) : '') .
+                       base64_encode(hash('sha256', $phrase, TRUE));
+               break;
+
+       // LDAP SSHA256
+       case '{ssha256}'        :
+               // SHA-2 SHA-256 Key length = 256bits = 32bytes
+               $salt = ($salt != '' ? substr(base64_decode($salt), 32) : substr(crypt(''), -8));
+               $hash = ($prefix ? ($canonical ? '{SSHA256}' : $scheme) : '') .
+                       base64_encode(hash('sha256', $phrase . $salt, TRUE) . $salt);
+               break;
+
+       // LDAP SHA384
+       case '{sha384}'        :
+               $hash = ($prefix ? ($canonical ? '{SHA384}' : $scheme) : '') .
+                       base64_encode(hash('sha384', $phrase, TRUE));
+               break;
+
+       // LDAP SSHA384
+       case '{ssha384}'        :
+               // SHA-2 SHA-384 Key length = 384bits = 48bytes
+               $salt = ($salt != '' ? substr(base64_decode($salt), 48) : substr(crypt(''), -8));
+               $hash = ($prefix ? ($canonical ? '{SSHA384}' : $scheme) : '') .
+                       base64_encode(hash('sha384', $phrase . $salt, TRUE) . $salt);
+               break;
+
+       // LDAP SHA512
+       case '{sha512}'        :
+               $hash = ($prefix ? ($canonical ? '{SHA512}' : $scheme) : '') .
+                       base64_encode(hash('sha512', $phrase, TRUE));
+               break;
+
+       // LDAP SSHA512
+       case '{ssha512}'        :
+               // SHA-2 SHA-512 Key length = 512bits = 64bytes
+               $salt = ($salt != '' ? substr(base64_decode($salt), 64) : substr(crypt(''), -8));
+               $hash = ($prefix ? ($canonical ? '{SSHA512}' : $scheme) : '') .
+                       base64_encode(hash('sha512', $phrase . $salt, TRUE) . $salt);
+               break;
+
        // LDAP CLEARTEXT and just cleartext
        case '{cleartext}'   : /* FALLTHROUGH */
        case ''              :

diff --git a/plugin/md5.inc.php b/plugin/md5.inc.php
index 8468878..854baa0 100644 (file)
--- a/plugin/md5.inc.php
+++ b/plugin/md5.inc.php
@@ -37,10 +37,10 @@ function plugin_md5_action()
                        array_push($scheme_list, 'x-php-sha1', 'SHA', 'SSHA');
                }
                if ($algos_enabled->sha256) {
-                       array_push($scheme_list, 'x-php-sha256');
+                       array_push($scheme_list, 'x-php-sha256', 'SHA256', 'SSHA256');
                }
                if ($algos_enabled->sha512) {
-                       array_push($scheme_list, 'x-php-sha512');
+                       array_push($scheme_list, 'x-php-sha512', 'SHA512', 'SSHA512');
                }
                if (!in_array($scheme, $scheme_list)) {
                        return array(
@@ -113,7 +113,20 @@ EOD;
   <label for="_p_md5_lsmd5">LDAP SMD5 (md5 with a seed) *</label><br />
   <input type="radio" name="scheme" id="_p_md5_lmd5" value="MD5" />
   <label for="_p_md5_lmd5">LDAP MD5</label><br />
-
+EOD;
+       if ($algos_enabled->sha256) $form .= <<<EOD
+  <input type="radio" name="scheme" id="_p_md5_lssha256" value="SSHA256"/>
+  <label for="_p_md5_lssha256">LDAP SSHA256 (sha256 with a seed) *</label><br />
+  <input type="radio" name="scheme" id="_p_md5_lsha256" value="SHA256" />
+  <label for="_p_md5_lsha256">LDAP SHA256</label><br />
+EOD;
+       if ($algos_enabled->sha512) $form .= <<<EOD
+  <input type="radio" name="scheme" id="_p_md5_lssha512" value="SSHA512"/>
+  <label for="_p_md5_lssha512">LDAP SSHA512 (sha512 with a seed) *</label><br />
+  <input type="radio" name="scheme" id="_p_md5_lsha512" value="SHA512" />
+  <label for="_p_md5_lsha512">LDAP SHA512</label><br />
+EOD;
+       $form .= <<<EOD
   <input type="checkbox" name="prefix" id="_p_md5_prefix" checked="checked" />
   <label for="_p_md5_prefix">Add scheme prefix (RFC2307, Using LDAP as NIS)</label><br />
 

diff --git a/pukiwiki.ini.php b/pukiwiki.ini.php
index df19034..2526515 100644 (file)
--- a/pukiwiki.ini.php
+++ b/pukiwiki.ini.php
@@ -185,6 +185,7 @@ $adminpass = '{x-php-md5}!';
 //$adminpass = '{CRYPT}$1$AR.Gk94x$uCe8fUUGMfxAPH83psCZG/';   // LDAP CRYPT 'pass'
 //$adminpass = '{MD5}Gh3JHJBzJcaScd3wyUS8cg==';               // LDAP MD5   'pass'
 //$adminpass = '{SMD5}o7lTdtHFJDqxFOVX09C8QnlmYmZnd2Qx';      // LDAP SMD5  'pass'
+//$adminpass = '{SHA256}10/w7o2juYBrGMh32/KbveULW9jk2tejpyUAD+uC6PE=' // LDAP SHA256 'pass'
 
 /////////////////////////////////////////////////
 // Page-reading feature settings