From 6d552f1ced36c738e54e3b09d6bef1d8b5b17b20 Mon Sep 17 00:00:00 2001 From: rajk93 Date: Wed, 23 Jul 2025 12:10:03 +0530 Subject: [PATCH] Added validation checks in PBKDF2 and Scrypt hashing functions (#584) * chore: added validation checks in PBKDF2 and Scrypt functions * chore(eslint): ignore linting for mod.ts * chore(ci): bump RUST_VER * chore(ci): bump RUST_VER * chore(CI): downgrade RUST_VER and update xargo build script * chore(CI): revert last change and use RUST_VER as stable * chore(CI): bump BINDGEN_VER * chore(CI): bump BINDGEN_VER * chore(CI): bump BINARYEN_VER * chore(CI): downgrade BINARYEN_VER * chore(CI): recomended fix for wasm-bindgen * chore(test): point wasm to package * Revert "chore(test): point wasm to package" This reverts commit 66104540fdff0e760ca0a6a666d4e09d162c5769. * chore(test): temporary test * Revert "chore(test): temporary test" This reverts commit af10b8d8b9bb597e02ea9c8d6cc3bf62676a6609. * chore(test): added more logs to build-wasm.sh script * Revert "chore(test): added more logs to build-wasm.sh script" This reverts commit c5073005ae9daa84308296736a41636da8f3d21b. * chore(test): added more logs to test all * Revert "chore(test): added more logs to test all" This reverts commit 9b0ac43c2c053ac408164bbf9b31b46d0844af1b. * chore: add references for RFCs --- eslint.config.js | 7 +- packages/wasm-crypto/Cargo.lock | 195 +++++++++++++++---------- packages/wasm-crypto/Cargo.toml | 2 +- packages/wasm-crypto/src/rs/hashing.rs | 26 ++++ scripts/install-build-deps.sh | 4 +- scripts/rust-version.sh | 2 +- 6 files changed, 155 insertions(+), 81 deletions(-) diff --git a/eslint.config.js b/eslint.config.js index 7d449116..70aada21 100644 --- a/eslint.config.js +++ b/eslint.config.js @@ -4,5 +4,10 @@ import baseConfig from '@polkadot/dev/config/eslint'; export default [ - ...baseConfig + ...baseConfig, + { + ignores: [ + 'mod.ts' + ] + } ]; diff --git a/packages/wasm-crypto/Cargo.lock b/packages/wasm-crypto/Cargo.lock index 1d826f28..49c745f1 100644 --- a/packages/wasm-crypto/Cargo.lock +++ b/packages/wasm-crypto/Cargo.lock @@ -1,6 +1,6 @@ # This file is automatically @generated by Cargo. # It is not intended for manual editing. -version = 3 +version = 4 [[package]] name = "addr2line" @@ -54,9 +54,9 @@ dependencies = [ [[package]] name = "bitflags" -version = "1.2.1" +version = "2.9.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "cf1de2fe8c75bc145a2f577add951f8134889b4795d47466a54a5c846d691693" +checksum = "1b8e56985ec62d17e9c1001dc89c88ecd7dc08e47eba5ec7c29c7b5eeecde967" [[package]] name = "blake2-rfc" @@ -125,15 +125,6 @@ version = "1.0.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd" -[[package]] -name = "cloudabi" -version = "0.0.3" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "ddfc5b9aa5d4507acaf872de71051dfd0e309860e88966e1051e462a077aac4f" -dependencies = [ - "bitflags", -] - [[package]] name = "constant_time_eq" version = "0.1.5" @@ -219,7 +210,7 @@ checksum = "aa4da3c766cd7a0db8242e326e9e4e081edd567072893ed320008189715366a4" dependencies = [ "proc-macro2", "quote", - "syn", + "syn 1.0.89", "synstructure", ] @@ -313,27 +304,12 @@ version = "0.1.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "67c21572b4949434e4fc1e1978b99c5f77064153c59d998bf13ecd96fb5ecba7" -[[package]] -name = "lazy_static" -version = "1.4.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "e2abad23fbc42b3700f2f279844dc832adb2b2eb069b2df918f455c4e18cc646" - [[package]] name = "libc" version = "0.2.108" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "8521a1b57e76b1ec69af7599e75e38e7b7fad6610f037db8c79b127201b5d119" -[[package]] -name = "lock_api" -version = "0.3.4" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "c4da24a77a3d8a6d4862d95f72e6fdb9c09a643ecdb402d754004a557f2bec75" -dependencies = [ - "scopeguard", -] - [[package]] name = "log" version = "0.4.11" @@ -384,11 +360,11 @@ checksum = "1ab52be62400ca80aa00285d25253d7f7c437b7375c4de678f5405d3afe82ca5" [[package]] name = "once_cell" -version = "1.4.0" +version = "1.21.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0b631f7e854af39a1739f401cf34a8a013dfe09eac4fa4dba91e9768bd28168d" +checksum = "42f5e15c9953c5e4ccceeb2e7382a716482c34515315f7b03532b8b4e8393d2d" dependencies = [ - "parking_lot", + "parking_lot_core", ] [[package]] @@ -397,28 +373,17 @@ version = "0.2.3" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "2839e79665f131bdb5782e51f2c6c9599c133c6098982a54c794358bf432529c" -[[package]] -name = "parking_lot" -version = "0.10.2" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d3a704eb390aafdc107b0e392f56a82b668e3a71366993b5340f5833fd62505e" -dependencies = [ - "lock_api", - "parking_lot_core", -] - [[package]] name = "parking_lot_core" -version = "0.7.2" +version = "0.9.11" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d58c7c768d4ba344e3e8d72518ac13e259d7c7ade24167003b8488e10b6740a3" +checksum = "bc838d2a56b5b1a6c25f55575dfc605fabb63bb2365f6c2353ef9159aa69e4a5" dependencies = [ - "cfg-if 0.1.10", - "cloudabi", + "cfg-if 1.0.0", "libc", "redox_syscall", "smallvec", - "winapi", + "windows-targets", ] [[package]] @@ -445,18 +410,18 @@ checksum = "99c605b9a0adc77b7211c6b1f722dcb613d68d66859a44f3d485a6da332b0598" [[package]] name = "proc-macro2" -version = "1.0.36" +version = "1.0.95" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "c7342d5883fbccae1cc37a2353b09c87c9b0f3afd73f5fb9bba687a1f733b029" +checksum = "02b3e5e68a3a1a02aad3ec490a98007cbc13c37cbe84a3cd7b8e406d76e7f778" dependencies = [ - "unicode-xid", + "unicode-ident", ] [[package]] name = "quote" -version = "1.0.7" +version = "1.0.40" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "aa563d17ecb180e500da1cfd2b028310ac758de548efdd203e18f283af693f37" +checksum = "1885c039570dc00dcb4ff087a89e185fd56bae234ddc7f056a945bf36467248d" dependencies = [ "proc-macro2", ] @@ -504,9 +469,12 @@ dependencies = [ [[package]] name = "redox_syscall" -version = "0.1.57" +version = "0.5.13" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "41cc0f7e4d5d4544e8861606a285bb08d3e70712ccc7d2b84d7c0ccfaf4b05ce" +checksum = "0d04b7d0ee6b4a0207a0a7adb104d23ecb0b47d6beae7152d0fa34b692b29fd6" +dependencies = [ + "bitflags", +] [[package]] name = "rustc-demangle" @@ -538,12 +506,6 @@ dependencies = [ "zeroize", ] -[[package]] -name = "scopeguard" -version = "1.1.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d29ab0c6d3fc0ee92fe66e2d99f700eab17a8d57d1c1d3b748380fb20baa78cd" - [[package]] name = "scrypt" version = "0.2.0" @@ -601,9 +563,9 @@ checksum = "29f060a7d147e33490ec10da418795238fd7545bba241504d6b31a409f2e6210" [[package]] name = "smallvec" -version = "1.4.1" +version = "1.15.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "3757cb9d89161a2f24e1cf78efa0c1fcff485d18e3f55e0aa3480824ddaa0f3f" +checksum = "67b1b7a3b5fe4f1376887184045fcf45c69e92af734b7aaddc05fb777b6fbd03" [[package]] name = "subtle" @@ -628,6 +590,17 @@ dependencies = [ "unicode-xid", ] +[[package]] +name = "syn" +version = "2.0.104" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "17b6f705963418cdb9927482fa304bc562ece2fdd4f616084c50b7023b435a40" +dependencies = [ + "proc-macro2", + "quote", + "unicode-ident", +] + [[package]] name = "synstructure" version = "0.12.4" @@ -636,7 +609,7 @@ checksum = "b834f2d66f734cb897113e34aaff2f1ab4719ca946f9a7358dba8f8064148701" dependencies = [ "proc-macro2", "quote", - "syn", + "syn 1.0.89", "unicode-xid", ] @@ -686,6 +659,12 @@ version = "1.12.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "373c8a200f9e67a0c95e62a4f52fbf80c23b4381c05a17845531982fa99e6b33" +[[package]] +name = "unicode-ident" +version = "1.0.18" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "5a5f39404a5da50712a4c1eecf25e90dd62b613502b7e925fd4e4d19b5c96512" + [[package]] name = "unicode-normalization" version = "0.1.13" @@ -740,9 +719,9 @@ dependencies = [ [[package]] name = "wasm-bindgen" -version = "0.2.79" +version = "0.2.91" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "25f1af7423d8588a3d840681122e72e6a24ddbcb3f0ec385cac0d12d24256c06" +checksum = "c1e124130aee3fb58c5bdd6b639a0509486b0338acaaae0c84a5124b0f588b7f" dependencies = [ "cfg-if 1.0.0", "wasm-bindgen-macro", @@ -750,24 +729,24 @@ dependencies = [ [[package]] name = "wasm-bindgen-backend" -version = "0.2.79" +version = "0.2.91" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "8b21c0df030f5a177f3cba22e9bc4322695ec43e7257d865302900290bcdedca" +checksum = "c9e7e1900c352b609c8488ad12639a311045f40a35491fb69ba8c12f758af70b" dependencies = [ "bumpalo", - "lazy_static", "log", + "once_cell", "proc-macro2", "quote", - "syn", + "syn 2.0.104", "wasm-bindgen-shared", ] [[package]] name = "wasm-bindgen-macro" -version = "0.2.79" +version = "0.2.91" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "2f4203d69e40a52ee523b2529a773d5ffc1dc0071801c87b3d270b471b80ed01" +checksum = "b30af9e2d358182b5c7449424f017eba305ed32a7010509ede96cdc4696c46ed" dependencies = [ "quote", "wasm-bindgen-macro-support", @@ -775,22 +754,22 @@ dependencies = [ [[package]] name = "wasm-bindgen-macro-support" -version = "0.2.79" +version = "0.2.91" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "bfa8a30d46208db204854cadbb5d4baf5fcf8071ba5bf48190c3e59937962ebc" +checksum = "642f325be6301eb8107a83d12a8ac6c1e1c54345a7ef1a9261962dfefda09e66" dependencies = [ "proc-macro2", "quote", - "syn", + "syn 2.0.104", "wasm-bindgen-backend", "wasm-bindgen-shared", ] [[package]] name = "wasm-bindgen-shared" -version = "0.2.79" +version = "0.2.91" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "3d958d035c4438e28c70e4321a2911302f10135ce78a9c7834c0cab4123d06a2" +checksum = "4f186bd2dcf04330886ce82d6f33dd75a7bfcf69ecf5763b89fcde53b6ac9838" [[package]] name = "wee_alloc" @@ -826,6 +805,70 @@ version = "0.4.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f" +[[package]] +name = "windows-targets" +version = "0.52.6" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "9b724f72796e036ab90c1021d4780d4d3d648aca59e491e6b98e725b84e99973" +dependencies = [ + "windows_aarch64_gnullvm", + "windows_aarch64_msvc", + "windows_i686_gnu", + "windows_i686_gnullvm", + "windows_i686_msvc", + "windows_x86_64_gnu", + "windows_x86_64_gnullvm", + "windows_x86_64_msvc", +] + +[[package]] +name = "windows_aarch64_gnullvm" +version = "0.52.6" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "32a4622180e7a0ec044bb555404c800bc9fd9ec262ec147edd5989ccd0c02cd3" + +[[package]] +name = "windows_aarch64_msvc" +version = "0.52.6" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "09ec2a7bb152e2252b53fa7803150007879548bc709c039df7627cabbd05d469" + +[[package]] +name = "windows_i686_gnu" +version = "0.52.6" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "8e9b5ad5ab802e97eb8e295ac6720e509ee4c243f69d781394014ebfe8bbfa0b" + +[[package]] +name = "windows_i686_gnullvm" +version = "0.52.6" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "0eee52d38c090b3caa76c563b86c3a4bd71ef1a819287c19d586d7334ae8ed66" + +[[package]] +name = "windows_i686_msvc" +version = "0.52.6" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "240948bc05c5e7c6dabba28bf89d89ffce3e303022809e73deaefe4f6ec56c66" + +[[package]] +name = "windows_x86_64_gnu" +version = "0.52.6" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "147a5c80aabfbf0c7d901cb5895d1de30ef2907eb21fbbab29ca94c5b08b1a78" + +[[package]] +name = "windows_x86_64_gnullvm" +version = "0.52.6" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "24d5b23dc417412679681396f2b49f3de8c1473deb516bd34410872eff51ed0d" + +[[package]] +name = "windows_x86_64_msvc" +version = "0.52.6" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec" + [[package]] name = "zeroize" version = "1.1.0" @@ -843,6 +886,6 @@ checksum = "de251eec69fc7c1bc3923403d18ececb929380e016afe103da75f396704f8ca2" dependencies = [ "proc-macro2", "quote", - "syn", + "syn 1.0.89", "synstructure", ] diff --git a/packages/wasm-crypto/Cargo.toml b/packages/wasm-crypto/Cargo.toml index ddb6ed81..2b06b860 100644 --- a/packages/wasm-crypto/Cargo.toml +++ b/packages/wasm-crypto/Cargo.toml @@ -32,7 +32,7 @@ sha2 = "0.8.1" tiny-bip39 = { version = "0.7", default-features = false } tiny-keccak = { version = "2.0.1", features = ["keccak"] } twox-hash = "1.5.0" -wasm-bindgen = "=0.2.79" +wasm-bindgen = "0.2.88" wee_alloc = "0.4.3" [dev-dependencies] diff --git a/packages/wasm-crypto/src/rs/hashing.rs b/packages/wasm-crypto/src/rs/hashing.rs index 7d3c806b..82a1faf7 100644 --- a/packages/wasm-crypto/src/rs/hashing.rs +++ b/packages/wasm-crypto/src/rs/hashing.rs @@ -100,6 +100,11 @@ pub fn ext_keccak512(data: &[u8]) -> Vec { /// Returns a vector with the hashed result #[wasm_bindgen] pub fn ext_pbkdf2(data: &[u8], salt: &[u8], rounds: u32) -> Vec { + // As per RFC 2898 [https://datatracker.ietf.org/doc/html/rfc2898], the number of rounds must be greater than 0 + if rounds == 0 { + panic!("PBKDF2 rounds must be greater than 0"); + } + let mut res = [0u8; 64]; // we cast to usize here - due to the WASM, we'd rather have u32 inputs @@ -119,6 +124,11 @@ pub fn ext_pbkdf2(data: &[u8], salt: &[u8], rounds: u32) -> Vec { /// Returns vector with the hashed result #[wasm_bindgen] pub fn ext_scrypt(password: &[u8], salt: &[u8], log2_n: u8, r: u32, p: u32) -> Vec { + // As per RFC 7914 [https://datatracker.ietf.org/doc/html/rfc7914.html], the cost parameter N (2 ^ log2_n) must be larger than 1 + if log2_n == 0 { + panic!("Scrypt cost parameter N must be larger than 1, log2_n must be at least 1"); + } + match ScryptParams::new(log2_n, r, p) { Ok(p) => { let mut res = [0u8; 64]; @@ -254,6 +264,14 @@ pub mod tests { assert_eq!(hash[..], expected[..]); } + #[test] + #[should_panic(expected = "PBKDF2 rounds must be greater than 0")] + fn pbkdf2_zero_rounds_panics() { + let salt = b"this is a salt"; + let data = b"hello world"; + ext_pbkdf2(data, salt, 0); + } + #[test] fn can_scrypt() { let password = b"password"; @@ -264,6 +282,14 @@ pub mod tests { assert_eq!(hash[..], expected[..]); } + #[test] + #[should_panic(expected = "Scrypt cost parameter N must be larger than 1, log2_n must be at least 1")] + fn scrypt_zero_log2_n_panics() { + let password = b"password"; + let salt = b"salt"; + ext_scrypt(password, salt, 0, 8, 1); + } + #[test] fn can_sha256() { let data = b"hello world"; diff --git a/scripts/install-build-deps.sh b/scripts/install-build-deps.sh index 5df16a6e..e31692c7 100755 --- a/scripts/install-build-deps.sh +++ b/scripts/install-build-deps.sh @@ -9,11 +9,11 @@ source ./scripts/rust-version.sh # NOTE If this is bumped, bump the version in Cargo.toml as well BINDGEN_REPO=https://github.com/rustwasm/wasm-bindgen -BINDGEN_VER=0.2.79 +BINDGEN_VER=0.2.91 BINDGEN_ZIP= BINARYEN_REPO=https://github.com/WebAssembly/binaryen -BINARYEN_VER=version_105 +BINARYEN_VER=version_120 BINARYEN_ZIP= WABT_REPO=https://github.com/WebAssembly/wabt diff --git a/scripts/rust-version.sh b/scripts/rust-version.sh index 6bcea052..d8be5694 100755 --- a/scripts/rust-version.sh +++ b/scripts/rust-version.sh @@ -3,5 +3,5 @@ # This software may be modified and distributed under the terms # of the Apache-2.0 license. See the LICENSE file for details. -RUST_VER=nightly-2021-12-02 +RUST_VER=stable # RUST_VER=stable