Skip to content

Bug in Verify code when rounds is specified #9

@ulziibay

Description

@ulziibay

When using https://pkg.go.dev/bytes#SplitN as part of the Decode step for Verify call, the $<id>[$<param>=<value>(,<param>=<value>)*][$<salt>[$<hash>]] formatted string is not properly split, leading into incorrect results for Verify
See: https://play.golang.org/p/Pk8URcLJxmx

For a hash string like this, the results in a tokens array that has incorrectly combined the hash with the salt. $6$rounds=10000$mysalt$9XTP7570fxVN/uTspSrH6kRPdR4KKGzGz7.TmJjDYGrKSwZuavW/3YaLur8JX6WP75Czcxa.megIO0lKreY0R.
Thus, call at https://github.com/GehirnInc/crypt/blob/master/common/salt.go#L125 incorrectly parses the salt, leading to error in the Verification.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions