|
[
Permalink
| « Hide
]
Alexander Peshkov added a comment - 14/Apr/19 06:08 PM
Slightly offtopic - never used to notice that effect myself, great that you've found relatively stable case.
Yep, bytes of course.
Here backup and original security3.fdb database. User/password are test/test https://www.dropbox.com/s/0qc79m69fix0byi/security3.bak?dl=1 https://www.dropbox.com/s/1wej7tbiphm2any/security3.fdb?dl=1 You've meant 128 bytes I suppose.
No - it should not. Treat verifier as a very big integer. When upper byte is 0 it's just omitted and this looks like 127-byte verifier. If you have any DB with such verifier please send it to me - want to fix. Looks I've found root of problem:
In some cases verifier (SrpManager.cpp: server.computeVerifier(user->userName()->get(), s1, user->password()->get()).getBytes(s);) which is should be 128 bit number generated as 127 bit. When selecting (SrpServer.cpp: "SELECT PLG$VERIFIER, PLG$SALT FROM PLG$SRP WHERE PLG$USER_NAME = ? AND PLG$ACTIVE";) it casted to array of 128 bits (SrpServer.cpp: verifier.assign(reinterpret_cast<const UCHAR*>((const char*)verify), RemotePassword::SRP_VERIFIER_SIZE);) and padded with extra zero bytes at right. So after this casting we will get wrong verifier. For example if we pad verifier from left when selecting it will be casted properly: SELECT LPAD(PLG$VERIFIER, 128), PLG$SALT FROM PLG$SRP WHERE PLG$USER_NAME = ? AND PLG$ACTIVE" The question is it always should be 128 bit or not? |