summaryrefslogtreecommitdiff
path: root/src/leap
diff options
context:
space:
mode:
authorKali Kaneko <kali@leap.se>2017-06-30 12:38:40 +0200
committerVictor Shyba <victor1984@riseup.net>2017-07-08 03:15:05 -0300
commit88d52a578d0d7b06e138820fc0df24ba5f22e0e1 (patch)
tree91ba56f8f90ad4d555d1b6ef3f2b9534881d6448 /src/leap
parent4672cb4be9c01d89b17b772331531b6502fb72ba (diff)
[feat] use OpenSSL backend for scrypt if available
This needs OpenSSL >= 1.1, otherwise it will keep using the scrypt dependency. We should think about deprecating scrypt as a dependency when we can be sure that the adoption of libssl 1.1 is wide enough. I think that at some point (soledad 0.11 or so) we can drop the scrypt dependency, which was being somehow problematic at times (the _scrypt.so was not appearing when installing with pip, needed workarounds). From that moment on, we can raise an error if an old libssl is found and no scrypt can be imported - leaving that to the user/packager. In debian stretch and afterwards, you can get that version by installing libssl-dev - Related: #8472
Diffstat (limited to 'src/leap')
-rw-r--r--src/leap/soledad/client/_scrypt.py33
-rw-r--r--src/leap/soledad/client/_secrets/__init__.py7
-rw-r--r--src/leap/soledad/client/_secrets/crypto.py4
3 files changed, 38 insertions, 6 deletions
diff --git a/src/leap/soledad/client/_scrypt.py b/src/leap/soledad/client/_scrypt.py
new file mode 100644
index 00000000..2de3ab5e
--- /dev/null
+++ b/src/leap/soledad/client/_scrypt.py
@@ -0,0 +1,33 @@
+# -*- coding: utf-8 -*-
+# _scrypt.py
+# Copyright (C) 2017 LEAP Encryption Access Project
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program. If not, see <http://www.gnu.org/licenses/>.
+
+from cryptography.hazmat.backends.interfaces import ScryptBackend
+from cryptography.hazmat.backends import default_backend
+
+backend = default_backend()
+OPENSSL_HAS_SCRYPT = isinstance(backend, ScryptBackend)
+
+if OPENSSL_HAS_SCRYPT:
+ from cryptography.hazmat.primitives.kdf.scrypt import Scrypt
+
+ def hash(secret, salt, buflen=32):
+ return Scrypt(salt, buflen, 16384, 8, 1, backend).derive(secret)
+else:
+ import scrypt
+
+ def hash(secret, salt, buflen=32):
+ return scrypt.hash(secret, salt, buflen=buflen)
diff --git a/src/leap/soledad/client/_secrets/__init__.py b/src/leap/soledad/client/_secrets/__init__.py
index b6c81cda..c92b9905 100644
--- a/src/leap/soledad/client/_secrets/__init__.py
+++ b/src/leap/soledad/client/_secrets/__init__.py
@@ -16,13 +16,13 @@
# along with this program. If not, see <http://www.gnu.org/licenses/>.
import os
-import scrypt
from leap.soledad.common.log import getLogger
from leap.soledad.client._secrets.storage import SecretsStorage
from leap.soledad.client._secrets.crypto import SecretsCrypto
from leap.soledad.client._secrets.util import emit, UserDataMixin
+from leap.soledad.client import _scrypt
logger = getLogger(__name__)
@@ -121,9 +121,8 @@ class Secrets(UserDataMixin):
def local_key(self):
# local storage key is scrypt-derived from `local_secret` and
# `local_salt` above
- secret = scrypt.hash(
- password=self.local_secret,
+ return _scrypt.hash(
+ self.local_secret,
salt=self.local_salt,
buflen=32, # we need a key with 256 bits (32 bytes)
)
- return secret
diff --git a/src/leap/soledad/client/_secrets/crypto.py b/src/leap/soledad/client/_secrets/crypto.py
index 8148151d..975b790b 100644
--- a/src/leap/soledad/client/_secrets/crypto.py
+++ b/src/leap/soledad/client/_secrets/crypto.py
@@ -18,13 +18,13 @@
import binascii
import json
import os
-import scrypt
from leap.soledad.common import soledad_assert
from leap.soledad.common.log import getLogger
from leap.soledad.client._crypto import encrypt_sym, decrypt_sym, ENC_METHOD
from leap.soledad.client._secrets.util import SecretsError
+from leap.soledad.client import _scrypt
logger = getLogger(__name__)
@@ -39,7 +39,7 @@ class SecretsCrypto(object):
def _get_key(self, salt):
passphrase = self._soledad.passphrase.encode('utf8')
- key = scrypt.hash(passphrase, salt, buflen=32)
+ key = _scrypt.hash(passphrase, salt, buflen=32)
return key
#