module Shield::Password

Constants

Error
MAX_LEN

DOS attack fix

Excessively long passwords (e.g. 1MB strings) would hang a server.

@see: www.djangoproject.com/weblog/2013/sep/15/security/

Public Class Methods

check(password, encrypted) click to toggle source
# File lib/shield.rb, line 115
def self.check(password, encrypted)
  sha512, salt = encrypted.to_s[0...128], encrypted.to_s[128..-1]

  Armor.compare(digest(password, salt), sha512)
end
encrypt(password, salt = generate_salt) click to toggle source
# File lib/shield.rb, line 111
def self.encrypt(password, salt = generate_salt)
  digest(password, salt) + salt
end

Protected Class Methods

digest(password, salt) click to toggle source
# File lib/shield.rb, line 122
def self.digest(password, salt)
  raise Error if password.length > MAX_LEN

  Armor.digest(password, salt)
end
generate_salt() click to toggle source
# File lib/shield.rb, line 128
def self.generate_salt
  Armor.hex(OpenSSL::Random.random_bytes(32))
end