Zaki/Password-Manager
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(kdf): neutralize the /migrate-kdf endpoint server-side (6c-1 / 6c-4)

Browse Source 
6c-1 removed the client caller, but the server handler stayed armed: a stray
authed+CSRF'd call could still re-encrypt only 1 blob of 8 (data loss) or
rewrite a -v2 account's hash_algo (permanent lockout, 6c-4). Gutted the ~165
destructive lines and replaced the body with an auth+CSRF gate then HTTP 410.
Both risks are now closed server-side, not merely unreachable by convention.
The vestigial kdfMigration login signal is left (client ignores it, endpoint
410s) — removing it would cascade through a login-path param for no benefit.
Fixed the now-false comments pointing at migrate-kdf.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
r-zakarya
2026-07-20 05:43:39 +01:00
parent 47aec30934
commit 370432f638
2 changed files with 27 additions and 188 deletions
Download Patch File Download Diff File Expand all files Collapse all files
delphi-backend/Handlers/PM.Handler.Auth.pas
+18 -182
View File
@@ -206,8 +206,10 @@ begin
LObj.AddPair('csrfToken', ACSRFToken);
// kdfIterations is the iteration count the client must use when deriving
// the AES-GCM key for THIS session — matches the count under which the
// existing entries are encrypted. If the server signals migration, the
// client should re-encrypt with the new target and call /migrate-kdf.
// existing entries are encrypted. NOTE: the kdfMigration signal below is
// now VESTIGIAL — /migrate-kdf was disabled (§6c-1) and the client ignores
// it. Legacy accounts upgrade via /change-master-password instead. Kept to
// avoid churning the login hot path; harmless (endpoint returns 410).
LObj.AddPair('kdfIterations', TJSONNumber.Create(AKdfIterations));
if ANeedsMigration then
begin
@@ -643,26 +645,18 @@ begin
end;
// ===== /migrate-kdf ==========================================================
// Atomic transition from an old PBKDF2 iteration count to the current target.
// Client side: derive both old and new AES keys, decrypt each entry with old,
// re-encrypt with new, then POST the new ciphertext blob to this endpoint
// along with the master password (so we can recompute the new server hash).
// Server side: verify the master pw with the old hash, then in a single
// transaction: update users.password_hash to the new PBKDF2 output, set
// kdf_iterations to TARGET, and replace each entry's encrypted_password/iv.
// All-or-nothing: if anything fails, the user stays on the old config.
// DISABLED 2026-07-16 (§6c-1 / §6c-4). This path re-derived the AES key
// (100k -> 600k) but re-encrypted ONLY encrypted_password — totp_secret,
// custom_fields, the *_enc metadata + attachments stayed under the old key =
// data loss — and it would rewrite a -v2 account's hash_algo, permanently
// locking it out. The client no longer calls it; any stray call is rejected so
// it can neither corrupt nor brick a vault. Legacy <600k accounts upgrade
// safely via /change-master-password (re-encrypts everything + moves to
// Argon2id).
procedure HandleMigrateKdf(ARequest: TIdHTTPRequestInfo;
AResponse: TIdHTTPResponseInfo; const AParams: TArray<string>);
var
LUserId, LOldIters, I: Integer;
LBody, LEntry: TJSONObject;
LEntries: TJSONArray;
LUser, LPwd, LOldVerifier, LNewVerifier, LSalt, LStoredHash, LAlgo, LIP,
LComputed, LNewHash: string;
LQ: TFDQuery;
LValid: Boolean;
LEntryId: Integer;
LEncPwd, LIv: string;
LUserId: Integer;
begin
try
LUserId := Authenticate(ARequest, AResponse);
@@ -670,166 +664,8 @@ begin
except
on ESessionRejected do Exit;
end;
LIP := GetClientIP(ARequest);
LBody := TJSONHelper.ReadBody(ARequest);
try
LPwd := LBody.GetValue<string>('masterPassword', '');
// ZK path: client provides PBKDF2 hex at the OLD iter count (oldVerifier,
// for current-hash verification) AND at the new TARGET iter count
// (newVerifier, for the post-migration stored hash).
LOldVerifier := LBody.GetValue<string>('oldVerifier', '');
LNewVerifier := LBody.GetValue<string>('newVerifier', '');
LEntries := LBody.GetValue<TJSONArray>('entries');
if LEntries = nil then
begin
TJSONHelper.SendError(AResponse, 400, 'Missing entries array');
Exit;
end;
DB.Lock;
try
// Step 1: load current user state.
LQ := TFDQuery.Create(nil);
try
LQ.Connection := DB.Connection;
LQ.SQL.Text :=
'SELECT username, password_hash, salt, hash_algo, kdf_iterations ' +
'FROM users WHERE id = :uid';
LQ.ParamByName('uid').AsInteger := LUserId;
LQ.Open;
if LQ.IsEmpty then
begin
TJSONHelper.SendError(AResponse, 401, 'User not found');
Exit;
end;
LUser := LQ.FieldByName('username').AsString;
LStoredHash := LQ.FieldByName('password_hash').AsString;
LSalt := LQ.FieldByName('salt').AsString;
LAlgo := LQ.FieldByName('hash_algo').AsString;
LOldIters := LQ.FieldByName('kdf_iterations').AsInteger;
if LAlgo = '' then LAlgo := 'pbkdf2';
if LOldIters <= 0 then LOldIters := PBKDF2_ITERATIONS;
finally
LQ.Free;
end;
// Idempotency: nothing to do if BOTH iter count is at target AND
// hash format is current. Previously we short-circuited on iter
// count alone, which would have skipped the hash-format upgrade for
// users who migrated KDF before this commit landed.
if (LOldIters >= PBKDF2_ITERATIONS_TARGET) and
SameText(LAlgo, HASH_ALGO_CURRENT) then
begin
TJSONHelper.SendOK(AResponse, 'Already at target');
Exit;
end;
// Step 2: verify the master pw against the CURRENT (old) hash. Prefer
// the ZK verifier path; fall back to plaintext for legacy clients.
LValid := False;
if LOldVerifier <> '' then
LValid := CheckVerifier(LOldVerifier, LStoredHash, LAlgo)
else if SameText(LAlgo, HASH_ALGO_LEGACY) then
begin
LComputed := PBKDF2_SHA256_Hex(LPwd, LSalt, LOldIters);
LValid := ConstantTimeEquals(LComputed, LStoredHash);
end
else if SameText(LAlgo, HASH_ALGO_CURRENT) then
begin
LComputed := ComputeAuthHashCurrent(LPwd, LSalt, LOldIters);
LValid := ConstantTimeEquals(LComputed, LStoredHash);
end;
if not LValid then
begin
RecordFailedAccountAttempt(LUser, LIP);
LogAudit(LUserId, 'failed_migrate_kdf', LIP);
TJSONHelper.SendError(AResponse, 401, 'Invalid password');
Exit;
end;
// Step 3: compute the new password hash under the current scheme
// (SHA-256 wrap) at the target iter count. ZK path takes the
// newVerifier (PBKDF2 at the target iters, computed client-side) and
// just wraps it; plaintext path runs PBKDF2 server-side.
if LNewVerifier <> '' then
begin
if not IsValidVerifier(LNewVerifier) then
begin
TJSONHelper.SendError(AResponse, 400, 'Malformed newVerifier');
Exit;
end;
LNewHash := VerifierToStoredHash(LNewVerifier, HASH_ALGO_CURRENT);
end
else
LNewHash := ComputeAuthHashCurrent(LPwd, LSalt, PBKDF2_ITERATIONS_TARGET);
// Step 4: atomic transaction — update user hash AND every entry's
// ciphertext together. Any failure rolls back, leaving the user on
// the legacy config (safe to retry next login).
DB.Connection.StartTransaction;
try
LQ := TFDQuery.Create(nil);
try
LQ.Connection := DB.Connection;
// Update hash, iter count, AND hash_algo all in one row update.
// hash_algo := HASH_ALGO_CURRENT is what completes the migration
// away from the "stored hash IS the AES key" architectural flaw.
LQ.SQL.Text :=
'UPDATE users SET password_hash = :h, kdf_iterations = :it, ' +
' hash_algo = :algo ' +
'WHERE id = :uid';
LQ.ParamByName('h').AsString := LNewHash;
LQ.ParamByName('it').AsInteger := PBKDF2_ITERATIONS_TARGET;
LQ.ParamByName('algo').AsString := HASH_ALGO_CURRENT;
LQ.ParamByName('uid').AsInteger := LUserId;
LQ.ExecSQL;
finally
LQ.Free;
end;
LQ := TFDQuery.Create(nil);
try
LQ.Connection := DB.Connection;
LQ.SQL.Text :=
'UPDATE vault_entries ' +
'SET encrypted_password = :ep, iv = :iv, updated_at = CURRENT_TIMESTAMP ' +
'WHERE id = :id AND user_id = :uid';
for I := 0 to LEntries.Count - 1 do
begin
LEntry := LEntries.Items[I] as TJSONObject;
LEntryId := LEntry.GetValue<Integer>('id', 0);
LEncPwd := LEntry.GetValue<string>('encrypted_password', '');
LIv := LEntry.GetValue<string>('iv', '');
if (LEntryId <= 0) or (LEncPwd = '') or (LIv = '') then
raise Exception.CreateFmt('Invalid entry payload at index %d', [I]);
LQ.ParamByName('id').AsInteger := LEntryId;
LQ.ParamByName('uid').AsInteger := LUserId;
LQ.ParamByName('ep').AsString := LEncPwd;
LQ.ParamByName('iv').AsString := LIv;
LQ.ExecSQL;
end;
finally
LQ.Free;
end;
DB.Connection.Commit;
except
DB.Connection.Rollback;
raise;
end;
finally
DB.Unlock;
end;
finally
LBody.Free;
end;
LogAudit(LUserId, Format('migrate_kdf %d->%d', [LOldIters, PBKDF2_ITERATIONS_TARGET]), LIP);
TJSONHelper.SendOK(AResponse, 'Migration complete');
TJSONHelper.SendError(AResponse, 410,
'KDF migration disabled — rotate the master password instead');
end;
// ===== POST /change-master-password ==========================================
@@ -852,9 +688,9 @@ end;
// working past the pw change.
// - Writes an audit_log entry.
//
// The /migrate-kdf endpoint exists for the same "re-encrypt all entries"
// pattern when the master pw stays the same; this endpoint differs by
// rotating the salt + pw too.
// This is now the ONLY correct "re-encrypt all entries under a new key" path
// (the old /migrate-kdf was disabled in §6c-1 for re-encrypting just 1 blob
// of 8). Legacy <600k accounts reach 600k + Argon2id through here.
procedure HandleChangeMasterPassword(ARequest: TIdHTTPRequestInfo;
AResponse: TIdHTTPResponseInfo; const AParams: TArray<string>);
var