Andrew Boyson / web

Common stuff for all my devices' web server pages: css, login, log, ipv4, ipv6, firmware update, clock, reset info etc.

Dependents:   oldheating gps motorhome heating

Security

A password has to be set whenever there has been a software reset. Resets following faults or power on do not require a new password as the hash is restored from the RTC GPREG register.

The password is not saved on the device; instead a 32 bit hash of the password is saved. It would take 2^31 attempts to brute force the password: this could be done in under a month if an attempt were possible every millisecond. To prevent this a 200 ms delay is introduced in the reply to the login form, that gives a more reasonable 13 years to brute force the password.

Once the password is accepted a random session id is created. This is 36 bit to give six base 64 characters but without an extra delay. If an attempt could be made every ms then this would still take over a year to brute force.

The most likely attack would to use a dictionary with, say, 10 million entries against the password which would still take 20 days to do.

login/web-login-session-id.c@103:91194cc19bbb, 2019-04-27 (annotated)

Committer:
andrewboyson
Date:
Sat Apr 27 09:25:28 2019 +0000
Revision:
103:91194cc19bbb
Parent:
login/http-login-session-id.c@81:4551f2e0e79b 
Renamed everything from Http to Web

Who changed what in which revision?

UserRevisionLine numberNew contents of line
andrewboyson 71:d6aacc7d62ab 1 #include <stdbool.h>
andrewboyson 79:e4cf94f9c9b2 2 #include <stdint.h>
andrewboyson 71:d6aacc7d62ab 3
andrewboyson 79:e4cf94f9c9b2 4 #include "random.h"
andrewboyson 71:d6aacc7d62ab 5
andrewboyson 81:4551f2e0e79b 6 #define SESSION_ID_BIT_LENGTH 36
andrewboyson 71:d6aacc7d62ab 7
andrewboyson 81:4551f2e0e79b 8 static char sessionId[(SESSION_ID_BIT_LENGTH + 5) / 6 + 1]; //Bit lengths not divisible by 6 require an extra space
andrewboyson 80:9ea202546e7f 9
andrewboyson 103:91194cc19bbb 10 void WebLoginSessionIdNew()
andrewboyson 71:d6aacc7d62ab 11 {
andrewboyson 81:4551f2e0e79b 12 char acc = 0;
andrewboyson 80:9ea202546e7f 13
andrewboyson 81:4551f2e0e79b 14 for (int i = 0; i < SESSION_ID_BIT_LENGTH; i++)
andrewboyson 80:9ea202546e7f 15 {
andrewboyson 81:4551f2e0e79b 16 int srcByte = i / 8;
andrewboyson 81:4551f2e0e79b 17 int srcBit = i - srcByte * 8;
andrewboyson 81:4551f2e0e79b 18 uint8_t srcMask = 1 << srcBit;
andrewboyson 81:4551f2e0e79b 19
andrewboyson 81:4551f2e0e79b 20 int dstByte = i / 6;
andrewboyson 81:4551f2e0e79b 21 int dstBit = i - dstByte * 6;
andrewboyson 81:4551f2e0e79b 22 uint8_t dstMask = 1 << dstBit;
andrewboyson 81:4551f2e0e79b 23
andrewboyson 81:4551f2e0e79b 24 //Reset the accumulator to zero at start of a 6 bit word
andrewboyson 81:4551f2e0e79b 25 if (!dstBit) acc = 0;
andrewboyson 80:9ea202546e7f 26
andrewboyson 81:4551f2e0e79b 27 //Add the bit to the accumulator
andrewboyson 81:4551f2e0e79b 28 if (RandomBytes[srcByte] & srcMask) acc |= dstMask;
andrewboyson 80:9ea202546e7f 29
andrewboyson 81:4551f2e0e79b 30 //Convert the accumulator to base64 and store in the session Id
andrewboyson 81:4551f2e0e79b 31 if (dstBit == 5 || i == SESSION_ID_BIT_LENGTH - 1)
andrewboyson 81:4551f2e0e79b 32 {
andrewboyson 81:4551f2e0e79b 33 if (acc < 26) sessionId[dstByte] = acc - 0 + 'A';
andrewboyson 81:4551f2e0e79b 34 else if (acc < 52) sessionId[dstByte] = acc - 26 + 'a';
andrewboyson 81:4551f2e0e79b 35 else if (acc < 62) sessionId[dstByte] = acc - 52 + '0';
andrewboyson 81:4551f2e0e79b 36 else if (acc < 63) sessionId[dstByte] = '+';
andrewboyson 81:4551f2e0e79b 37 else sessionId[dstByte] = '/';
andrewboyson 81:4551f2e0e79b 38 }
andrewboyson 80:9ea202546e7f 39 }
andrewboyson 81:4551f2e0e79b 40 sessionId[(SESSION_ID_BIT_LENGTH + 5) / 6] = 0;
andrewboyson 71:d6aacc7d62ab 41 }
andrewboyson 81:4551f2e0e79b 42
andrewboyson 103:91194cc19bbb 43 bool WebLoginSessionIdIsSet()
andrewboyson 71:d6aacc7d62ab 44 {
andrewboyson 81:4551f2e0e79b 45 return sessionId[0];
andrewboyson 71:d6aacc7d62ab 46 }
andrewboyson 103:91194cc19bbb 47 char* WebLoginSessionIdGet()
andrewboyson 71:d6aacc7d62ab 48 {
andrewboyson 81:4551f2e0e79b 49 return sessionId;
andrewboyson 71:d6aacc7d62ab 50 }