CSteipp has uploaded a new change for review.
https://gerrit.wikimedia.org/r/178285
Change subject: Use truncated sha256 for token hmac
......................................................................
Use truncated sha256 for token hmac
Although md5 is considered safe for hmac, updating to sha256 may keep
things safer longer. The security tradeoffs of truncated hmac is pretty
well studied.
Change-Id: I2297451cf0c68f3b99265b173ced9dc5b3c98730
---
M includes/User.php
M tests/phpunit/includes/api/ApiTestCase.php
2 files changed, 8 insertions(+), 2 deletions(-)
git pull ssh://gerrit.wikimedia.org:29418/mediawiki/core
refs/changes/85/178285/1
diff --git a/includes/User.php b/includes/User.php
index 5348020..eebad9a 100644
--- a/includes/User.php
+++ b/includes/User.php
@@ -3899,7 +3899,11 @@
if ( is_array( $salt ) ) {
$salt = implode( '|', $salt );
}
- return hash_hmac( 'md5', $timestamp . $salt, $token,
false ) .
+ // Use only the left-most 128 bits from sha256 hmac.
This is considered
+ // safe for hmac's, see
https://tools.ietf.org/html/rfc2104
+ return substr(
+ hash_hmac( 'sha256', $timestamp .
$salt, $token, false ),
+ 0, 32 ) .
dechex( $timestamp ) .
self::EDIT_TOKEN_SUFFIX;
}
diff --git a/tests/phpunit/includes/api/ApiTestCase.php
b/tests/phpunit/includes/api/ApiTestCase.php
index 9a552fa..6c29c53 100644
--- a/tests/phpunit/includes/api/ApiTestCase.php
+++ b/tests/phpunit/includes/api/ApiTestCase.php
@@ -144,7 +144,9 @@
$session['wsEditToken'] = $session['wsToken'];
// add token to request parameters
$timestamp = wfTimestamp();
- $params['token'] = hash_hmac( 'md5', $timestamp,
$session['wsToken'] ) .
+ $params['token'] = substr(
+ hash_hmac( 'sha256', $timestamp,
$session['wsToken'] ),
+ 0, 32 ) .
dechex( $timestamp ) .
User::EDIT_TOKEN_SUFFIX;
--
To view, visit https://gerrit.wikimedia.org/r/178285
To unsubscribe, visit https://gerrit.wikimedia.org/r/settings
Gerrit-MessageType: newchange
Gerrit-Change-Id: I2297451cf0c68f3b99265b173ced9dc5b3c98730
Gerrit-PatchSet: 1
Gerrit-Project: mediawiki/core
Gerrit-Branch: master
Gerrit-Owner: CSteipp <[email protected]>
_______________________________________________
MediaWiki-commits mailing list
[email protected]
https://lists.wikimedia.org/mailman/listinfo/mediawiki-commits
