ericelliott / credential

Easy password hashing and verification in Node. Protects against brute force, rainbow tables, and timing attacks.
MIT License
348 stars 28 forks source link

I can't make the cli work #45

Closed mastilver closed 8 years ago

mastilver commented 8 years ago

this work: echo -n "my password" | credential hash - | credential verify - "my password"

But if I do: credential hash password

and then: credential verify <the previous output> password It's throwing me: Unexpected token ':"w6iqo4XwaKPzWn7B541EW+kWeVmJ9bMMv3WNMPPutWuwwSdJecntnXDBFw Xc+MO/dtAFnZKkdg+bBPIjJOqUpKGJ"' in expression or statement.

I can't figure out why...

tjconcept commented 8 years ago
$ credential hash "test" --work 0.01
{"salt":"YTMazeNKJ12xRowgWSNFuiis4igrd5Ic4l202RMnh+9ikgfWhliTXgSLM8FzlzSfAqydVJO8j8UQhOHrM+YT8jJV","hash":"c2NilQ1y+tuFh/z65dG94J703cCWFdW0l5MqY4As8O9U36xbaIbS89R3JrlGPagUFCw1qJrPte4lGB2DH64GyHNl","keyLength":66,"hashMethod":"pbkdf2","iterations":2454}
$ credential verify '{"salt":"YTMazeNKJ12xRowgWSNFuiis4igrd5Ic4l202RMnh+9ikgfWhliTXgSLM8FzlzSfAqydVJO8j8UQhOHrM+YT8jJV","hash":"c2NilQ1y+tuFh/z65dG94J703cCWFdW0l5MqY4As8O9U36xbaIbS89R3JrlGPagUFCw1qJrPte4lGB2DH64GyHNl","keyLength":66,"hashMethod":"pbkdf2","iterations":2454}' "test"
Verified

Could it be an escaping issue? What is your result from:

$ TEST=$(credential hash test --work 0.01)
$ credential verify $TEST test
mastilver commented 8 years ago

I've just tried that: verify '{"hash":"Bo8VvwqqJu0jC6aji9t/CBjFT52sYAaMpfuOZ88vIqB8ORhpGS4V21gSAYHM+GH3+IbZTkh8VnnMego1jgt6xga0","salt":"vnhth+OOghJy+rfdEddukuAZjthcM6sDPoeSfLWOoVpFctjEgsqAlJXVgI2QyIKizMllCY9hHtXjXPSfrwqtN/lW","keyLength":66,"hashMethod":"pbkdf2","iterations":245737}' password

I got back; [Error: Couldn't parse stored hash.]

I'm on a windows computer right now, I will try later on *unix

tjconcept commented 8 years ago

Could you try logging the input when doing a verify? Somehow the JSON is missing or corrupted.

mastilver commented 8 years ago

so I've put: console.log(typeof hash, hash);

It displays me: string {hash:Bo8VvwqqJu0jC6aji9t/CBjFT52sYAaMpfuOZ88vIqB8ORhpGS4V21gSAYHM+GH3+IbZTkh8VnnMego1jgt6xga0,salt:vnhth+OOghJy+rfdEddukuAZjthcM6sDPoeSfLWOoVpFctjEgsqAlJXVgI2QyIKizMllCY9hHtXjXPSfrwqtN/lW,keyLength:66,hashMethod:pbkdf2,iterations:245737}

mastilver commented 8 years ago

Could it be an escaping issue?

Must be that... Can you think of a way to fix it without breaking unix (I'm guessing it's working fine on unix)

tjconcept commented 8 years ago

Weird.. That string is not valid JSON because the " are missing. To me it seems like either your shell or something in between is doing bad stuff. At least I don't think it is a "code issue".

Could you try putting in something else with a " and see how it is received in Node? I don't have a Windows VM available atm. so I can't really debug.

mastilver commented 8 years ago

yep it's a windows issue (yet another one... ): http://stackoverflow.com/questions/7760545/cmd-escape-double-quotes-in-parameter I should have check that earlier

tjconcept commented 8 years ago

:+1: