[openmeetings] branch master updated: [OPENMEETINGS-2567] scrypt cost is made configurable

[solomax]

This is an automated email from the ASF dual-hosted git repository.

solomax pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/openmeetings.git


The following commit(s) were added to refs/heads/master by this push:
     new 26633d9  [OPENMEETINGS-2567] scrypt cost is made configurable
26633d9 is described below

commit 26633d9a6f64078dc1355952ca517688214c39e0
Author: Maxim Solodovnik <solomax...@gmail.com>
AuthorDate: Thu Feb 11 09:49:53 2021 +0700

    [OPENMEETINGS-2567] scrypt cost is made configurable
---
 .../openmeetings/util/crypt/SCryptImplementation.java      | 14 +++++++++++++-
 .../main/webapp/WEB-INF/classes/openmeetings.properties    |  3 +++
 2 files changed, 16 insertions(+), 1 deletion(-)

diff --git 
a/openmeetings-util/src/main/java/org/apache/openmeetings/util/crypt/SCryptImplementation.java
 
b/openmeetings-util/src/main/java/org/apache/openmeetings/util/crypt/SCryptImplementation.java
index 7be9b6f..34ba241 100644
--- 
a/openmeetings-util/src/main/java/org/apache/openmeetings/util/crypt/SCryptImplementation.java
+++ 
b/openmeetings-util/src/main/java/org/apache/openmeetings/util/crypt/SCryptImplementation.java
@@ -20,8 +20,10 @@ package org.apache.openmeetings.util.crypt;
 
 import static java.nio.charset.StandardCharsets.UTF_8;
 
+import java.io.InputStream;
 import java.security.NoSuchAlgorithmException;
 import java.security.SecureRandom;
+import java.util.Properties;
 
 import org.apache.commons.codec.binary.Base64;
 import org.bouncycastle.crypto.generators.SCrypt;
@@ -42,7 +44,7 @@ public class SCryptImplementation implements ICrypt {
                                }
                                return sr;
                        });
-       private static final int COST = 1024 * 16;
+       private static int COST = 1024 * 16;
        private static final int KEY_LENGTH = 512;
        private static final int SALT_LENGTH = 200;
 
@@ -52,6 +54,16 @@ public class SCryptImplementation implements ICrypt {
                return salt;
        }
 
+       SCryptImplementation() {
+               try (final InputStream is = 
getClass().getResourceAsStream("/openmeetings.properties")) {
+                       Properties props = new Properties();
+                       props.load(is);
+                       COST = Integer.valueOf(props.getProperty("scrypt.cost", 
"" + COST));
+               } catch (Exception e) {
+                       log.error("Failed to initialize the COST", e);
+               }
+       }
+
        private static String hash(String str, byte[] salt) {
                byte[] dk = SCrypt.generate(str.getBytes(UTF_8), salt, COST, 8, 
8, KEY_LENGTH);
                return Base64.encodeBase64String(dk);
diff --git 
a/openmeetings-web/src/main/webapp/WEB-INF/classes/openmeetings.properties 
b/openmeetings-web/src/main/webapp/WEB-INF/classes/openmeetings.properties
index 3dc2989..37315c4 100644
--- a/openmeetings-web/src/main/webapp/WEB-INF/classes/openmeetings.properties
+++ b/openmeetings-web/src/main/webapp/WEB-INF/classes/openmeetings.properties
@@ -16,6 +16,9 @@
 # specific language governing permissions and limitations
 # under the License.
 #
+################## Crypt ##################
+scrypt.cost=16384
+
 ################## Timeouts ##################
 #                      5000            == 5 sec
 #                      300000          == 5 min