On Fri, Sep 30, 2011 at 4:02 PM, Dmitry Chestnykh <[email protected]>wrote:
> I have attached a patch to sha.c with HMAC implementation, and > double-signing. > :-D > Basically, if zKey is a random secret string stored in the database, and > zRest is a concatenation of the values you want to store in the cookie (e.g. > login/ip-address/project-code): > So zKey is the per-user secret or repo secret? If i understand correctly, this change just replaces the repo secret with user secret. Is that correct? ac474c1a90651e71b36c1cf5f29f884fe773707e/login/ip-address/project-code > > Set this as a cookie. > Thank you! Will this be part of the timing-based change which Richard asked be put in the trunk? If so, i'll wait until it's in there. -- ----- stephan beal http://wanderinghorse.net/home/stephan/
_______________________________________________ fossil-users mailing list [email protected] http://lists.fossil-scm.org:8080/cgi-bin/mailman/listinfo/fossil-users
