feat(auth): change master password with full vault re-encryption
Adds the canonical PM feature: let the user pick a new master password
and have every entry transparently re-encrypted under the new key,
without ever exposing plaintext to the server.
Backend endpoint: POST /change-master-password
==============================================
Body:
{
currentMasterPassword, verified against current stored hash
newMasterPassword, basis for the new hash + new client key
newSalt, 64-char hex, client-generated
entries: [{ id, encrypted_password, iv,
totp_secret?, totp_iv? }, ...]
}
Flow:
1. Authenticate + RequireCSRF (caller already logged in).
2. RejectIfAccountLocked — pw change is brute-forceable through a
hijacked session, so it respects the same per-account lockout as
/login.
3. Verify currentMasterPassword against the stored hash. Branches on
hash_algo to handle both legacy 'pbkdf2' and current 'pbkdf2-sha256'.
Wrong pw → RecordFailedAccountAttempt + audit + 401.
4. Compute new auth hash = SHA256(PBKDF2(new_pw, new_salt, 600k)),
always using the current scheme (migration baked in).
5. ATOMIC transaction:
UPDATE users SET password_hash, salt, kdf_iterations, hash_algo
UPDATE vault_entries SET encrypted_password, iv, totp_secret, totp_iv
(per entry)
Any failure → rollback, user stays on the old config.
6. DeleteAllUserSessions — every OTHER session is invalidated so a
leaked old token can't keep working past the rotation. The current
caller's session stays valid.
7. ClearAccountLockout + audit_log entry.
8. Returns { message, salt, kdfIterations }.
Client
======
New modal in index.html (#changeMasterModal) with three password
fields (current / new / confirm) + inline error display. Added a
"Change master password" button in the Settings panel → Account
section. Escape-key handler routes through it like the other modals.
doChangeMasterPassword():
1. Local validation: all fields filled, new ≥ 8 chars, new == confirm,
new ≠ current. Fast failure beats a round trip.
2. randomHexSalt() → 32 secure random bytes, hex-encoded.
3. Derive newKey = PBKDF2(new_pw, new_salt, 600k).
4. Walk state.entries: decrypt password + (optional) TOTP under the
current key, re-encrypt under newKey with fresh random IVs.
One decrypt failure aborts the whole change — better than partial
commit.
5. POST to /change-master-password.
6. On success: swap state.salt + state.cryptoKey, persistCryptoKey,
update sessionStorage, refresh cached ciphertexts in state.entries,
close modal, toast.
7. On 401 / 429 / generic error: show inline error in the modal so
the user can fix and retry without re-typing everything.
Threat model notes
==================
- The current session token stays valid because the new server hash
only invalidates OTHER sessions. Self-logout would be needlessly
disruptive (user already proved knowledge of both pws).
- Server still sees the old + new master pws transiently in /change-
master-password. Same trade-off as /login — eliminating it requires
redesigning to send pre-computed verifiers (SRP-style), tracked
separately.
- The salt rotates with the password — best-practice against any
precomputed dictionary attack tied to the previous salt.
This commit is contained in:
@@ -626,11 +626,225 @@ begin
|
||||
TJSONHelper.SendOK(AResponse, 'Migration complete');
|
||||
end;
|
||||
|
||||
// ===== POST /change-master-password ==========================================
|
||||
// Body: {
|
||||
// currentMasterPassword, // verified against current stored hash
|
||||
// newMasterPassword, // basis for new hash + new client AES key
|
||||
// newSalt, // 64-char hex, client-generated
|
||||
// entries: [{ id, encrypted_password, iv, totp_secret?, totp_iv? }, ...]
|
||||
// // entries re-encrypted client-side with the
|
||||
// // new key (derived from new pw + new salt)
|
||||
// }
|
||||
//
|
||||
// All-or-nothing transaction: verifies current, then in one tx updates the
|
||||
// user row (hash + salt + iter count + algo) AND every entry's ciphertext.
|
||||
// On any failure the user stays on the old config — they can retry without
|
||||
// data loss.
|
||||
//
|
||||
// Side effects:
|
||||
// - Invalidates ALL other sessions so a leaked old token can't keep
|
||||
// working past the pw change.
|
||||
// - Writes an audit_log entry.
|
||||
//
|
||||
// The /migrate-kdf endpoint exists for the same "re-encrypt all entries"
|
||||
// pattern when the master pw stays the same; this endpoint differs by
|
||||
// rotating the salt + pw too.
|
||||
procedure HandleChangeMasterPassword(ARequest: TIdHTTPRequestInfo;
|
||||
AResponse: TIdHTTPResponseInfo; const AParams: TArray<string>);
|
||||
var
|
||||
LUserId, I: Integer;
|
||||
LBody, LEntry, LObj: TJSONObject;
|
||||
LEntries: TJSONArray;
|
||||
LUser, LCurPwd, LNewPwd, LNewSalt, LStoredHash, LOldSalt, LAlgo, LIP,
|
||||
LComputed, LNewHash: string;
|
||||
LOldIters: Integer;
|
||||
LQ: TFDQuery;
|
||||
LValid: Boolean;
|
||||
LEntryId: Integer;
|
||||
LEncPwd, LIv, LTotpSec, LTotpIv: string;
|
||||
begin
|
||||
try
|
||||
LUserId := Authenticate(ARequest, AResponse);
|
||||
RequireCSRF(ARequest, AResponse, LUserId);
|
||||
except
|
||||
on ESessionRejected do Exit;
|
||||
end;
|
||||
|
||||
LIP := GetClientIP(ARequest);
|
||||
|
||||
LBody := TJSONHelper.ReadBody(ARequest);
|
||||
try
|
||||
LCurPwd := LBody.GetValue<string>('currentMasterPassword', '');
|
||||
LNewPwd := LBody.GetValue<string>('newMasterPassword', '');
|
||||
LNewSalt := LBody.GetValue<string>('newSalt', '');
|
||||
LEntries := LBody.GetValue<TJSONArray>('entries');
|
||||
|
||||
// Input validation. Length 64 = 32 raw bytes in hex, matches the salt
|
||||
// format produced by RandomHex(32) and client-side randomHexSalt().
|
||||
if (Length(LCurPwd) < 1) or (Length(LNewPwd) < 8) then
|
||||
begin
|
||||
TJSONHelper.SendError(AResponse, 400,
|
||||
'New master password must be at least 8 characters');
|
||||
Exit;
|
||||
end;
|
||||
if Length(LNewSalt) <> 64 then
|
||||
begin
|
||||
TJSONHelper.SendError(AResponse, 400, 'Invalid newSalt length');
|
||||
Exit;
|
||||
end;
|
||||
if LEntries = nil then
|
||||
begin
|
||||
TJSONHelper.SendError(AResponse, 400, 'Missing entries array');
|
||||
Exit;
|
||||
end;
|
||||
|
||||
DB.Lock;
|
||||
try
|
||||
// Step 1: load current state.
|
||||
LQ := TFDQuery.Create(nil);
|
||||
try
|
||||
LQ.Connection := DB.Connection;
|
||||
LQ.SQL.Text :=
|
||||
'SELECT username, password_hash, salt, hash_algo, kdf_iterations ' +
|
||||
'FROM users WHERE id = :uid';
|
||||
LQ.ParamByName('uid').AsInteger := LUserId;
|
||||
LQ.Open;
|
||||
if LQ.IsEmpty then
|
||||
begin
|
||||
TJSONHelper.SendError(AResponse, 401, 'User not found');
|
||||
Exit;
|
||||
end;
|
||||
LUser := LQ.FieldByName('username').AsString;
|
||||
LStoredHash := LQ.FieldByName('password_hash').AsString;
|
||||
LOldSalt := LQ.FieldByName('salt').AsString;
|
||||
LAlgo := LQ.FieldByName('hash_algo').AsString;
|
||||
LOldIters := LQ.FieldByName('kdf_iterations').AsInteger;
|
||||
if LAlgo = '' then LAlgo := HASH_ALGO_LEGACY;
|
||||
if LOldIters <= 0 then LOldIters := PBKDF2_ITERATIONS;
|
||||
finally
|
||||
LQ.Free;
|
||||
end;
|
||||
|
||||
// Lockout protection on the pw change itself (same threat model as
|
||||
// /login — attacker with a hijacked session shouldn't be able to
|
||||
// brute-force the current pw to swap it for one they know).
|
||||
if RejectIfAccountLocked(AResponse, LUser) then Exit;
|
||||
|
||||
// Step 2: verify the CURRENT master pw.
|
||||
LValid := False;
|
||||
if SameText(LAlgo, HASH_ALGO_LEGACY) then
|
||||
begin
|
||||
LComputed := PBKDF2_SHA256_Hex(LCurPwd, LOldSalt, LOldIters);
|
||||
LValid := ConstantTimeEquals(LComputed, LStoredHash);
|
||||
end
|
||||
else if SameText(LAlgo, HASH_ALGO_CURRENT) then
|
||||
begin
|
||||
LComputed := ComputeAuthHashCurrent(LCurPwd, LOldSalt, LOldIters);
|
||||
LValid := ConstantTimeEquals(LComputed, LStoredHash);
|
||||
end;
|
||||
if not LValid then
|
||||
begin
|
||||
RecordFailedAccountAttempt(LUser, LIP);
|
||||
LogAudit(LUserId, 'failed_change_password', LIP);
|
||||
TJSONHelper.SendError(AResponse, 401, 'Current password is incorrect');
|
||||
Exit;
|
||||
end;
|
||||
|
||||
// Step 3: compute the new auth hash with the new salt + target iters.
|
||||
LNewHash := ComputeAuthHashCurrent(LNewPwd, LNewSalt, PBKDF2_ITERATIONS_TARGET);
|
||||
|
||||
// Step 4: atomic transaction — user row + every entry's ciphertext.
|
||||
DB.Connection.StartTransaction;
|
||||
try
|
||||
LQ := TFDQuery.Create(nil);
|
||||
try
|
||||
LQ.Connection := DB.Connection;
|
||||
LQ.SQL.Text :=
|
||||
'UPDATE users SET ' +
|
||||
' password_hash = :h, ' +
|
||||
' salt = :s, ' +
|
||||
' kdf_iterations = :it, ' +
|
||||
' hash_algo = :algo ' +
|
||||
'WHERE id = :uid';
|
||||
LQ.ParamByName('h').AsString := LNewHash;
|
||||
LQ.ParamByName('s').AsString := LNewSalt;
|
||||
LQ.ParamByName('it').AsInteger := PBKDF2_ITERATIONS_TARGET;
|
||||
LQ.ParamByName('algo').AsString := HASH_ALGO_CURRENT;
|
||||
LQ.ParamByName('uid').AsInteger := LUserId;
|
||||
LQ.ExecSQL;
|
||||
finally
|
||||
LQ.Free;
|
||||
end;
|
||||
|
||||
LQ := TFDQuery.Create(nil);
|
||||
try
|
||||
LQ.Connection := DB.Connection;
|
||||
LQ.SQL.Text :=
|
||||
'UPDATE vault_entries SET ' +
|
||||
' encrypted_password = :ep, iv = :iv, ' +
|
||||
' totp_secret = :ts, totp_iv = :tiv, ' +
|
||||
' updated_at = CURRENT_TIMESTAMP ' +
|
||||
'WHERE id = :id AND user_id = :uid';
|
||||
|
||||
for I := 0 to LEntries.Count - 1 do
|
||||
begin
|
||||
LEntry := LEntries.Items[I] as TJSONObject;
|
||||
LEntryId := LEntry.GetValue<Integer>('id', 0);
|
||||
LEncPwd := LEntry.GetValue<string>('encrypted_password', '');
|
||||
LIv := LEntry.GetValue<string>('iv', '');
|
||||
LTotpSec := LEntry.GetValue<string>('totp_secret', '');
|
||||
LTotpIv := LEntry.GetValue<string>('totp_iv', '');
|
||||
if (LEntryId <= 0) or (LEncPwd = '') or (LIv = '') then
|
||||
raise Exception.CreateFmt('Invalid entry payload at index %d', [I]);
|
||||
|
||||
LQ.ParamByName('id').AsInteger := LEntryId;
|
||||
LQ.ParamByName('uid').AsInteger := LUserId;
|
||||
LQ.ParamByName('ep').AsString := LEncPwd;
|
||||
LQ.ParamByName('iv').AsString := LIv;
|
||||
// TOTP fields are optional per entry — clear when empty so
|
||||
// existing-NULL rows don't get stomped with empty strings.
|
||||
if LTotpSec = '' then LQ.ParamByName('ts').Clear
|
||||
else LQ.ParamByName('ts').AsString := LTotpSec;
|
||||
if LTotpIv = '' then LQ.ParamByName('tiv').Clear
|
||||
else LQ.ParamByName('tiv').AsString := LTotpIv;
|
||||
LQ.ExecSQL;
|
||||
end;
|
||||
finally
|
||||
LQ.Free;
|
||||
end;
|
||||
|
||||
DB.Connection.Commit;
|
||||
except
|
||||
DB.Connection.Rollback;
|
||||
raise;
|
||||
end;
|
||||
finally
|
||||
DB.Unlock;
|
||||
end;
|
||||
|
||||
// Step 5: invalidate every other session for this user. The CURRENT
|
||||
// session token is still valid — caller stays logged in.
|
||||
DeleteAllUserSessions(LUserId);
|
||||
finally
|
||||
LBody.Free;
|
||||
end;
|
||||
|
||||
ClearAccountLockout(LUser);
|
||||
LogAudit(LUserId, 'change_master_password', LIP);
|
||||
|
||||
LObj := TJSONObject.Create;
|
||||
LObj.AddPair('message', 'Master password changed');
|
||||
LObj.AddPair('salt', LNewSalt);
|
||||
LObj.AddPair('kdfIterations', TJSONNumber.Create(PBKDF2_ITERATIONS_TARGET));
|
||||
TJSONHelper.SendJSON(AResponse, LObj);
|
||||
end;
|
||||
|
||||
initialization
|
||||
Router.Register('POST', '/register', HandleRegister);
|
||||
Router.Register('POST', '/login', HandleLogin);
|
||||
Router.Register('POST', '/logout', HandleLogout);
|
||||
Router.Register('POST', '/reauth', HandleReauth);
|
||||
Router.Register('POST', '/migrate-kdf', HandleMigrateKdf);
|
||||
Router.Register('POST', '/register', HandleRegister);
|
||||
Router.Register('POST', '/login', HandleLogin);
|
||||
Router.Register('POST', '/logout', HandleLogout);
|
||||
Router.Register('POST', '/reauth', HandleReauth);
|
||||
Router.Register('POST', '/migrate-kdf', HandleMigrateKdf);
|
||||
Router.Register('POST', '/change-master-password', HandleChangeMasterPassword);
|
||||
|
||||
end.
|
||||
|
||||
Reference in New Issue
Block a user