warrentyexpired/ModernUO
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Adds SHA512 support for ServUO (#124)

Browse source
This commit is contained in:
Kamron Batman 2020-05-02 00:32:00 -07:00 • committed by GitHub
parent dad8a64fad
commit 2b4a6e1de1
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
8 changed files with 99 additions and 82 deletions
Download patch file Download diff file Expand all files Collapse all files

8
Projects/Scripts/Accounting/Security/AccountSecurity.cs
View file

@ -4,13 +4,14 @@ namespace Server.Accounting.Security
{
public enum PasswordProtectionAlgorithm
{
// Obsolete algorithms. These are not secure!
// Obsolete algorithms from RunUO. These are not secure!
// They are included for password upgrades only.
None,
MD5,
SHA1,
// Support algorithms
// Supported algorithms
SHA2, // ServUO compatibility
PBKDF2,
Argon2 // Recommended algorithm for real security.
}
@ -24,7 +25,7 @@ namespace Server.Accounting.Security
public static void Configure()
{
if (AlgorithmName < PasswordProtectionAlgorithm.PBKDF2)
if (AlgorithmName < PasswordProtectionAlgorithm.SHA2)
throw new Exception($"Security: {AlgorithmName} is obselete and not secure. Do not use it.");
}
@ -34,6 +35,7 @@ namespace Server.Accounting.Security
{
PasswordProtectionAlgorithm.MD5 => MD5PasswordProtection.Instance,
PasswordProtectionAlgorithm.SHA1 => SHA1PasswordProtection.Instance,
PasswordProtectionAlgorithm.SHA2 => SHA2PasswordProtection.Instance,
PasswordProtectionAlgorithm.PBKDF2 => PBKDF2PasswordProtection.Instance,
PasswordProtectionAlgorithm.Argon2 => Argon2PasswordProtection.Instance,
_ => null

4
Projects/Scripts/Accounting/Security/MD5PasswordProtection.cs
View file

@ -1,7 +1,7 @@
using System;
using System.Runtime.InteropServices;
using System.Security.Cryptography;
using System.Text;
using Server.Misc;
namespace Server.Accounting.Security
{
@ -16,7 +16,7 @@ namespace Server.Accounting.Security
byte[] bytes = new byte[Encoding.ASCII.GetByteCount(password)];
Encoding.ASCII.GetBytes(password, bytes);
return BitConverter.ToString(m_MD5HashProvider.ComputeHash(bytes));
return HexStringConverter.GetString(m_MD5HashProvider.ComputeHash(bytes));
}
public bool ValidatePassword(string encryptedPassword, string plainPassword) =>

4
Projects/Scripts/Accounting/Security/SHA1PasswordProtection.cs
View file

@ -1,7 +1,7 @@
using System;
using System.Runtime.InteropServices;
using System.Security.Cryptography;
using System.Text;
using Server.Misc;
namespace Server.Accounting.Security
{
@ -16,7 +16,7 @@ namespace Server.Accounting.Security
byte[] bytes = new byte[Encoding.ASCII.GetByteCount(password)];
Encoding.ASCII.GetBytes(password, bytes);
return BitConverter.ToString(m_SHA1HashProvider.ComputeHash(bytes));
return HexStringConverter.GetString(m_SHA1HashProvider.ComputeHash(bytes));
}
public bool ValidatePassword(string encryptedPassword, string plainPassword) =>

25
Projects/Scripts/Accounting/Security/SHA2PasswordProtection.cs Normal file
View file

@ -0,0 +1,25 @@
using System;
using System.Security.Cryptography;
using System.Text;
using Server.Misc;
namespace Server.Accounting.Security
{
public class SHA2PasswordProtection : IPasswordProtection
{
public static IPasswordProtection Instance = new SHA2PasswordProtection();
private SHA512CryptoServiceProvider m_SHA2HashProvider = new SHA512CryptoServiceProvider();
public string EncryptPassword(string plainPassword)
{
ReadOnlySpan<char> password = plainPassword.AsSpan(0, Math.Min(256, plainPassword.Length));
byte[] bytes = new byte[Encoding.ASCII.GetByteCount(password)];
Encoding.ASCII.GetBytes(password, bytes);
return HexStringConverter.GetString(m_SHA2HashProvider.ComputeHash(bytes));
}
public bool ValidatePassword(string encryptedPassword, string plainPassword) =>
EncryptPassword(plainPassword) == encryptedPassword;
}
}