|
| 1 | +using Codout.Security.Core; |
| 2 | +using Microsoft.Extensions.Options; |
| 3 | +using Sodium; |
| 4 | + |
| 5 | +namespace Codout.Security.Argon2 |
| 6 | +{ |
| 7 | + public class ArgonPasswordHash( |
| 8 | + IOptions<ImprovedPasswordHasherOptions>? optionsAccessor = null, |
| 9 | + IOptions<Argon2Options>? argon2OptionsAccessor = null) : IPasswordHasher |
| 10 | + { |
| 11 | + private readonly ImprovedPasswordHasherOptions _options = optionsAccessor?.Value ?? new ImprovedPasswordHasherOptions(); |
| 12 | + private readonly Argon2Options _argon2Options = argon2OptionsAccessor?.Value ?? new Argon2Options(); |
| 13 | + |
| 14 | + public string HashPassword(string password) |
| 15 | + { |
| 16 | + if (string.IsNullOrEmpty(password)) |
| 17 | + throw new ArgumentNullException(nameof(password), $"{nameof(password)} should not be null"); |
| 18 | + |
| 19 | + if (_argon2Options.OpsLimit.HasValue && _argon2Options.MemLimit.HasValue) |
| 20 | + return PasswordHash.ArgonHashString(password, _argon2Options.OpsLimit.Value, _argon2Options.MemLimit.Value).TrimEnd('\0'); |
| 21 | + |
| 22 | + return _options.Strength switch |
| 23 | + { |
| 24 | + PasswordHasherStrength.Interactive => PasswordHash.ArgonHashString(password).TrimEnd('\0'), |
| 25 | + PasswordHasherStrength.Moderate => PasswordHash.ArgonHashString(password, PasswordHash.StrengthArgon.Moderate).TrimEnd('\0'), |
| 26 | + PasswordHasherStrength.Sensitive => PasswordHash.ArgonHashString(password, PasswordHash.StrengthArgon.Sensitive).TrimEnd('\0'), |
| 27 | + _ => throw new ArgumentOutOfRangeException() |
| 28 | + }; |
| 29 | + } |
| 30 | + |
| 31 | + public PasswordVerificationResult VerifyHashedPassword(string hashedPassword, string providedPassword) |
| 32 | + { |
| 33 | + if (string.IsNullOrEmpty(hashedPassword)) |
| 34 | + throw new ArgumentNullException(nameof(hashedPassword), $"{nameof(hashedPassword)} should not be null"); |
| 35 | + |
| 36 | + if (string.IsNullOrEmpty(providedPassword)) |
| 37 | + throw new ArgumentNullException(nameof(providedPassword), $"{nameof(providedPassword)} should not be null"); |
| 38 | + |
| 39 | + if (!PasswordHash.ArgonHashStringVerify(hashedPassword, providedPassword)) |
| 40 | + return PasswordVerificationResult.Failed; |
| 41 | + |
| 42 | + return NeedsRehash(hashedPassword) |
| 43 | + ? PasswordVerificationResult.SuccessRehashNeeded |
| 44 | + : PasswordVerificationResult.Success; |
| 45 | + } |
| 46 | + |
| 47 | + private bool NeedsRehash(string hashedPassword) |
| 48 | + { |
| 49 | + // Parse Argon2 hash format: $argon2id$v=19$m=65536,t=3,p=1$salt$hash |
| 50 | + var parts = hashedPassword.Split('$'); |
| 51 | + if (parts.Length < 4) |
| 52 | + return false; |
| 53 | + |
| 54 | + var paramPart = parts[3]; |
| 55 | + var parameters = paramPart.Split(','); |
| 56 | + |
| 57 | + long storedMemKib = 0; |
| 58 | + long storedTimeCost = 0; |
| 59 | + |
| 60 | + foreach (var param in parameters) |
| 61 | + { |
| 62 | + if (param.StartsWith("m=") && long.TryParse(param.AsSpan(2), out var m)) |
| 63 | + storedMemKib = m; |
| 64 | + else if (param.StartsWith("t=") && long.TryParse(param.AsSpan(2), out var t)) |
| 65 | + storedTimeCost = t; |
| 66 | + } |
| 67 | + |
| 68 | + if (storedMemKib == 0 || storedTimeCost == 0) |
| 69 | + return false; |
| 70 | + |
| 71 | + var (expectedTimeCost, expectedMemKib) = GetExpectedParameters(); |
| 72 | + return storedTimeCost < expectedTimeCost || storedMemKib < expectedMemKib; |
| 73 | + } |
| 74 | + |
| 75 | + private (long timeCost, long memKib) GetExpectedParameters() |
| 76 | + { |
| 77 | + if (_argon2Options.OpsLimit.HasValue && _argon2Options.MemLimit.HasValue) |
| 78 | + return (_argon2Options.OpsLimit.Value, _argon2Options.MemLimit.Value / 1024); |
| 79 | + |
| 80 | + return _options.Strength switch |
| 81 | + { |
| 82 | + PasswordHasherStrength.Interactive => (2, 65536), // 64 MiB |
| 83 | + PasswordHasherStrength.Moderate => (3, 262144), // 256 MiB |
| 84 | + PasswordHasherStrength.Sensitive => (4, 1048576), // 1 GiB |
| 85 | + _ => (4, 1048576) |
| 86 | + }; |
| 87 | + } |
| 88 | + } |
| 89 | +} |
0 commit comments