Cesura / nxsh

BusyBox-like remote shell for the Nintendo Switch over telnet [UNMAINTAINED]
BSD 3-Clause "New" or "Revised" License
79 stars 7 forks source link

Switch to using sha256 to check the password #16

Closed friedkeenan closed 5 years ago

friedkeenan commented 5 years ago

Now that libnx has hardware accelerated crypto stuff, including sha256, I think it makes more sense to use sha256 for the password checking. Though, it wouldn't make too much of a difference since to find out the hash of the password, you'd have to have a level of access that means an attacker could already have done nasty stuff to your Switch.

I'm just making this issue to make sure there's no reason @Cesura specifically used MD5

Cesura commented 5 years ago

Nope, I only chose MD5 because it was easy to implement. In reality, it's a terrible choice and I'd jump at the opportunity to use stronger cryptography. :)

Does libnx have native hashing functions now?

EDIT: Just noticed your commit. Nice work, especially for catching that little oversight on my part.

friedkeenan commented 5 years ago

Yep, hardware accelerated and everything: https://switchbrew.github.io/libnx/dir_2874fbf892ad5b8020be2442f929b820.html

It's what I used for the hashing commands I added

friedkeenan commented 5 years ago

If you want, I can work on this later or tomorrow (should be relatively simple to add)

friedkeenan commented 5 years ago

Fixed with c88819edc4f2f083e450a676a8892bc73d34f82d