ranisalt / node-argon2 / 90
100%

DEFAULT BRANCH: master
Ran
Jobs 9
Files 2
Run time 2min
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst
90

Pull #12

travis-ci

cgmb 
Improve bad salt handling

Node's Buffer::toString interprets the data as UTF-8 by default. This
results in decoding errors when trying to convert the random bytes to
string, because some byte sequences are not valid unicode. The
replacement of invalid unicode with the Unicode Replacement Character
(U+FFFD) greatly decreases the entropy of the string and significantly
lengthens its representation in bytes. The later truncation of the
string to 16 bytes then further decreases its entropy.

Specifying that the string is ascii reduces entropy somewhat, as null
bytes are converted to spaces, and the high bit is stripped from each
byte. This is still better than the utf-8 errors, but not perfect.

Specifying the string as binary, unfortunately, results in a longer
representation when finally converted back to UTF-8 for hashing. There
may be a way to handle this in the C++ code, but it's unclear how you'd
identify the encoding given that we can't depend on the salt coming
from our own code.

Within the hash function itself, the use of std::strlen for determining
the length of the salt is inappropriate, as completely random strings
may contain null bytes.

There is a real question as to whether the password or the salt should
actually even be strings, but that can't be changed without breaking
backwards compatibility. Ideally, we'd just keep everything in byte
buffers and not worry about string encodings at all.
Pull Request #12: Improve bad salt handling

135 of 139 relevant lines covered (97.12%)

90.13 hits per line

Jobs
ID Job ID Ran Files Coverage
1 90.1 2
97.12
 Travis Job 90.1
2 90.2 2
97.12
 Travis Job 90.2
3 90.3 2
97.12
 Travis Job 90.3
4 90.4 2
97.12
 Travis Job 90.4
5 90.5 2
97.12
 Travis Job 90.5
6 90.6 2
97.12
 Travis Job 90.6
7 90.7 2
97.12
 Travis Job 90.7
8 90.8 2
97.12
 Travis Job 90.8
9 90.9 2
97.12
 Travis Job 90.9
Source Files on build 90
Coverage ∆ File Lines Relevant Covered Missed Hits/Line