ramakrishnach04 / vt-middleware

Automatically exported from code.google.com/p/vt-middleware
0 stars 0 forks source link

vt-password: HistoryRule does not support salt #136

Closed GoogleCodeExporter closed 8 years ago

GoogleCodeExporter commented 8 years ago
What steps will reproduce the problem?
1. build password history with salted SHA512 digester
2. build history rule and password validator
3. use password validator with history rule to check the password history
4. history rule never uses salt -> password always accepted

What is the expected output? What do you see instead?

I expected a method on the history rule to set both the digest algoritme and 
the salt (currently only algorithm as String and Converter are allowed)

What version of the product are you using? On what operating system?

using vt-password-3.1.1 and vt-crypt-2.1.4 on windows

Please provide any additional information below.

I'm happy to provide any additional information or source code patch for this. 
I looks trivial to add an overloaded method with this signature and I've done 
so in my own HistoryRule subclass.

See attached file for example of the problem

Original issue reported on code.google.com by jmsno...@gmail.com on 11 Jul 2012 at 12:51

Attachments:

GoogleCodeExporter commented 8 years ago
[deleted comment]
GoogleCodeExporter commented 8 years ago
Updated AbstractDigester to extract salts and apply them to the password for 
comparison.
Fixed in r2563.

Original comment by dfis...@gmail.com on 5 Dec 2012 at 4:21

GoogleCodeExporter commented 8 years ago
No comment from the reporter, but appears to be fixed.

Original comment by dfis...@gmail.com on 24 Apr 2013 at 9:09