search

keybase / keybase-issues

A single repo for managing publicly recognized issues with the keybase client, installer, and website.
900 stars 37 forks source link

Usability issues with POST /login related to Scrypt usage #263

Closed adamldoyle closed 10 years ago

adamldoyle commented 10 years ago

For the POST /login call, the expectation is to run the password through Scrypt using the earlier retrieved salt plus the configuration values of N=2^15, r=8, and p=1. However, many/most Scrypt implementation libraries don't directly expose N/r/p but instead rely on maxmem, maxmemfrac and maxtime. By relying on specific values for the Scrypt generated encoded string that aren't possible to set in libraries, it makes it incredibly difficult to make use of the API.

One potential option would be to set minimum required values (and maybe maximum) for the configuration values, but allow the calling code to use what they want. Additionally, if the expectation was to pass over the entire encrypted string instead of just encrypted[96:128], the server could extract the configuration values used, validate them, and then decode the string appropriately.

Libraries that were looked at that had issues: http://www.tarsnap.com/scrypt.html (Original C source library) https://bitbucket.org/mhallin/py-scrypt/src (Python) https://github.com/pbhogan/scrypt (Ruby)

maxtaco commented 10 years ago

Thanks for looking into this. We did a python version of triplesec, and that seemed to be OK with the N/r/p combo. Also, in Colin's library, crypto_scrypt seems to expose the N/r/p interface.

The reason why we decided against the maxmem/maxmemfrac/maxtime option was that you'd need to run scrypt on your phone, your browser, or your web client, and you'd need to get the same answer in all 3.

Finally, I think most litecoin implementations hardcode N=2^10/r=8/p=1, rather than the relative strengths.

adamldoyle commented 10 years ago

With respect to the C library, I suppose I was initially looking at scryptenc.c which is what the other libraries I mentioned use as their entry-point to Scrypt. Additionally, I was looking more at the encrypt/decrypt methods instead of the hash method, which does in fact expose N/r/p. Apparently I just wasn't looking in the right place (it doesn't help that all documentation for the libraries tends to focus on the maxmem/maxmemfrac/maxtime settings rather than the N/r/p settings).

maxtaco commented 10 years ago

Cool, let me know if I can with anything else.