module Shield::Password
Constants
- Error
- MAX_LEN
DOS attack fix¶ ↑
Excessively long passwords (e.g. 1MB strings) would hang a server.
Public Class Methods
check(password, encrypted)
click to toggle source
# File lib/shield.rb, line 115 def self.check(password, encrypted) sha512, salt = encrypted.to_s[0...128], encrypted.to_s[128..-1] Armor.compare(digest(password, salt), sha512) end
encrypt(password, salt = generate_salt)
click to toggle source
# File lib/shield.rb, line 111 def self.encrypt(password, salt = generate_salt) digest(password, salt) + salt end
Protected Class Methods
digest(password, salt)
click to toggle source
# File lib/shield.rb, line 122 def self.digest(password, salt) raise Error if password.length > MAX_LEN Armor.digest(password, salt) end
generate_salt()
click to toggle source
# File lib/shield.rb, line 128 def self.generate_salt Armor.hex(OpenSSL::Random.random_bytes(32)) end