scrypt - npm Package Compare versions

Comparing version 1.4.1 to 1.4.2

package.json

 {
     "name": "scrypt",
     "description": "The scrypt crypto library for NodeJS",
-    "version": "1.4.1",
+    "version": "1.4.2",
     "keywords": [
@@ -6,0 +6,0 @@ "scrypt",

Readme.md

@@ -5,3 +5,3 @@ #Scrypt For NodeJS
 ##What Is Scrypt? 
-Scrypt is an advanced crypto library used mainly for [key derivation](http://en.wikipedia.org/wiki/Key_derivation_function) (i.e. password authenticator). More information can be found:
+Scrypt is an advanced crypto library used mainly for [key derivation](http://en.wikipedia.org/wiki/Key_derivation_function) (i.e. password authenticator). More information can be found here:
 
@@ -12,3 +12,3 @@ * [Tarsnap blurb about scrypt](http://www.tarsnap.com/scrypt.html) - Colin Percival (the author of scrypt) explains a bit about it.
 
-For additional interest, also read the [key derivation function](http://en.wikipedia.org/wiki/Key_derivation_function) article on wikipedia.
+For additional interest, read the article on wikipedias about the [key derivation function](http://en.wikipedia.org/wiki/Key_derivation_function).
 
@@ -19,9 +19,9 @@ ###The Three Essential Properties Of Password Key Derivation
 * The password must not be stored in plaintext. (Therefore it is hashed).
-* The password hash must be salted. (Rainbow table attack is very difficult to pull off).
-* The salted hash function must not be fast. (If someone does get hold of the salted hashes, it will take a long time to brute force).
+* The password hash must be salted. (Making rainbow table attack is very difficult to pull off).
+* The salted hash function must not be fast. (If someone does get hold of the salted hashes, their only option will be brute force which will be very slow).
 
-This scrypt library automatically handles the above properties. The last item seems strange: Computer scientists are normally pre-occupied with making things fast. Yet it is this property that sets Scrypt apart from the competition. As computers evolve and get more powerful, they are able to attack this property more efficiently. This has become especially apparent with the rise of parallel programming. Scrypt aims to defend against all types of attacks, not matter the attackers power.
+This scrypt library automatically handles the above properties. The last item seems strange: Computer scientists are normally pre-occupied with making things fast. Yet it is this property that sets Scrypt apart from the competition. As computers evolve and get more powerful, they are able to attack this property more efficiently. This has become especially apparent with the rise of parallel programming. Scrypt aims to defend against all types of attacks, not matter the attackers power now or in the future.
 
-### What This Library Provides
-This library implements node modules for the following:
+### What This Module Provides
+This module implements the following:
 
@@ -255,3 +255,3 @@ * **Scrypt password key derivation**
     var cipher = scrypt.encryptSync(message, password, maxtime, maxmem, maxmemfrac);
-    var plainText = scrypt.decrypt(cipher, password, maxtime, maxmem, maxmemfrac);
+    var plainText = scrypt.decryptSync(cipher, password, maxtime, maxmem, maxmemfrac);
 
@@ -258,0 +258,0 @@ #Api

src/node-boilerplate/scrypt_node_async.cc

@@ -333,3 +333,3 @@ /*
     
-    //Local variables
+    //Arguments from JavaScript land
     String::Utf8Value password(args[0]->ToString());
@@ -364,3 +364,3 @@ Local<Function> callback = Local<Function>::Cast(args[callbackPosition]);
     
-    //perform scrypt encryption
+    //perform scrypt password hash
     baton->result = HashPassword(
@@ -372,8 +372,7 @@ (const uint8_t*)baton->password.c_str(),
 
-    //Base64 encode else things don't work (such is crypto)
-    char* base64Encode = base64_encode(outbuf, 96);
+    //Base64 encode for storage
+    int base64EncodedLength = calcBase64EncodedLength(96);
+    char base64Encode[base64EncodedLength + 1];
+    base64_encode(outbuf, 96, base64Encode);
     baton->output = base64Encode;
-
-    //Clean up
-    delete base64Encode;
 }
@@ -441,3 +440,3 @@
 
-    //Local variables
+    //Arguments from JavaScript land
     String::Utf8Value hash(args[0]->ToString());
@@ -469,13 +468,13 @@ String::Utf8Value password(args[1]->ToString());
     Baton* baton = static_cast<Baton*>(req->data);
-    int outlen;
-    unsigned const char* message = base64_decode(baton->message.c_str(), baton->message.length(), &outlen);
-  
+    
+    //Hashed password was encoded to base64, so we need to decode it now
+    int base64DecodedLength = calcBase64DecodedLength(baton->message.c_str());
+    unsigned char passwordHash[base64DecodedLength];
+    base64_decode(baton->message.c_str(), baton->message.length(), passwordHash);
+ 
     //perform work
     baton->result = VerifyHash(
-        message,
+        passwordHash,
         (const uint8_t*)baton->password.c_str()
     );
-
-    //Clean up
-    delete message;
 }
@@ -545,3 +544,3 @@
 
-    //Local variables
+    //Arguments from JavaScript land
     String::Utf8Value message(args[0]->ToString());
@@ -590,8 +589,7 @@ String::Utf8Value password(args[1]->ToString());
 
-    //Base64 encode else things don't work (such is crypto)
-    char* base64Encode = base64_encode(outbuf, outbufSize);
+    //Encode to base64 for storage purposes
+    int base64EncodedLength = calcBase64EncodedLength(outbufSize);
+    char base64Encode[base64EncodedLength + 1]; //+1 added for ending null char '\0'
+    base64_encode(outbuf, outbufSize, base64Encode);
     baton->output = base64Encode;
-
-    //Clean up
-    delete base64Encode;
 }
@@ -655,3 +653,3 @@
 
-    //Validate arguments
+    //Arguments from JavaScript land
     if (!(callbackPosition = ValidateCryptoArguments(args, validateMessage, maxmem, maxmemfrac, maxtime))) {
@@ -694,11 +692,13 @@ ThrowException(
     Baton* baton = static_cast<Baton*>(req->data);
-    
-    int outlen;
-    unsigned const char* message = base64_decode(baton->message.c_str(), baton->message.length(), &outlen);
-    uint8_t outbuf[outlen];
    
+    //When encrypting, output was encoded in base64. So now we need to decode to get to the original
+    int base64DecodedLength = calcBase64DecodedLength(baton->message.c_str());
+    unsigned char cipher[base64DecodedLength];
+    base64_decode(baton->message.c_str(), baton->message.length(), cipher);
+    uint8_t outbuf[base64DecodedLength];
+   
     //perform scrypt decryption
     baton->result = scryptdec_buf(
-        (const uint8_t*)message,
-        outlen,
+        (const uint8_t*)cipher,
+        (size_t) base64DecodedLength,
         outbuf,
@@ -712,5 +712,2 @@ &baton->outbuflen,
     baton->output = std::string((const char*)outbuf, baton->outbuflen);
-
-    //Clean up
-    delete message;
 }
@@ -717,0 +714,0 @@

src/node-boilerplate/scrypt_node_sync.cc

@@ -248,3 +248,2 @@ /*
     uint8_t outbuf[96]; //Header size for password derivation is fixed
-    int result;
     std::string output;
@@ -260,7 +259,7 @@
     
-    //Local variables
+    //Arguments from JavaScript land
     String::Utf8Value password(args[0]->ToString());
     
     //perform scrypt password hash
-    result = HashPassword(
+    int result = HashPassword(
         (const uint8_t*)*password,
@@ -277,8 +276,8 @@ outbuf,
     } else {
-        //Base64 encode else things don't work (such is crypto)
-        char* base64Encode = base64_encode(outbuf, 96);
-        output = base64Encode; //Deep copy
-        delete base64Encode;
+        //Base64 encode for storage
+        int base64EncodedLength = calcBase64EncodedLength(96);
+        char base64Encode[base64EncodedLength + 1];
+        base64_encode(outbuf, 96, base64Encode);
        
-        Local<String> passwordHash = String::New((const char*)output.c_str(), output.length()); 
+        Local<String> passwordHash = String::New((const char*)base64Encode, base64EncodedLength); 
         return scope.Close(passwordHash);
@@ -294,5 +293,2 @@ }
     std::string validateMessage;
-    int verifyHashResult;
-    int outlen;
-    unsigned const char* passwordHash;
 
@@ -307,9 +303,14 @@ //Validate arguments
 
-    //Local variables
+    //Arguments from JavaScript land
     String::Utf8Value hash(args[0]->ToString());
     String::Utf8Value password(args[1]->ToString());
-    passwordHash = base64_decode(*hash, hash.length(), &outlen);
+
+
+    //Hashed password was encoded to base64, so we need to decode it now
+    int base64DecodedLength = calcBase64DecodedLength(*hash);
+    unsigned char passwordHash[base64DecodedLength];
+    base64_decode(*hash, hash.length(), passwordHash);
     
     //perform scrypt password verify
-    verifyHashResult = VerifyHash(
+    int result = VerifyHash(
         passwordHash,
@@ -319,3 +320,3 @@ (const uint8_t*)*password
 
-    if (verifyHashResult) { //Password did not verify
+    if (result) { //Password did not verify
         return scope.Close(Local<Value>::New(Boolean::New(false)));
@@ -347,5 +348,7 @@ } else {
 
-    //Local variables
+    //Arguments from JavaScript land
     String::Utf8Value message(args[0]->ToString());
     String::Utf8Value password(args[1]->ToString());
+
+    //There is 128 byte header added that stores the hashed password
     uint32_t outbufSize = message.length() + 128;
@@ -364,3 +367,3 @@ uint8_t outbuf[outbufSize];
 
-    if (result) { //There has been an error
+    if (result) { //Scrypt error
         ThrowException(
@@ -371,8 +374,7 @@ Exception::TypeError(String::New(ScryptErrorDescr(result).c_str()))
     } else {
-        //Base64 encode else things don't work (such is crypto)
-        char* base64Encode = base64_encode(outbuf, outbufSize);
-        std::string cipher = base64Encode;
-        delete base64Encode; //Deleting this variable means that it can't be returned. Hence std::string cipher above
+        int base64EncodedLength = calcBase64EncodedLength(outbufSize);
+        char base64Encode[base64EncodedLength + 1]; //+1 added for ending null char '\0'
+        base64_encode(outbuf, outbufSize, base64Encode);
 
-        return scope.Close(Local<Value>::New(String::New((const char*)cipher.c_str(), cipher.length())));
+        return scope.Close(Local<Value>::New(String::New((const char*)base64Encode, base64EncodedLength)));
     }   
@@ -392,4 +394,2 @@ }
     std::string validateMessage;
-    int result,
-        outlen;
     size_t outbuflen;
@@ -405,13 +405,16 @@
 
-    //Local variables
+    //Arguments passed from JavaScript land
     String::Utf8Value message(args[0]->ToString());
     String::Utf8Value password(args[1]->ToString());
 
-    unsigned const char* cipher = base64_decode(*message, message.length(), &outlen);
-    uint8_t outbuf[outlen];
+    //When encrypting, output was encoded in base64. So now we need to decode to get to the original
+    int base64DecodedLength = calcBase64DecodedLength(*message);
+    unsigned char cipher[base64DecodedLength];
+    base64_decode(*message, message.length(), cipher);
+    uint8_t outbuf[base64DecodedLength];
 
     //Scrypt decryption done here
-    result = scryptdec_buf(
+    int result = scryptdec_buf(
         (const uint8_t*)cipher,
-        outlen,
+        (size_t)base64DecodedLength,
         outbuf,
@@ -424,6 +427,3 @@ &outbuflen,
     
-    //clean up
-    delete cipher;
-    
-    if (result) { //There has been an error
+    if (result) { //There has been a srypt error
         ThrowException(
@@ -430,0 +430,0 @@ Exception::TypeError(String::New(ScryptErrorDescr(result).c_str()))

src/util/base64.cc

@@ -31,2 +31,3 @@ /*
 #include <cstdlib>
+#include <stdio.h> //used for strlen
 #include "base64.h"
@@ -39,4 +40,20 @@
 
-char *
-base64_encode(const unsigned char *input, int length)
+int calcBase64EncodedLength(int strlen) {
+    return (strlen+2 - ((strlen+2)%3))*4/3;
+}
+
+int calcBase64DecodedLength(const char* b64input) {
+    int len = strlen(b64input);
+    int padding = 0;
+     
+    if (b64input[len-1] == '=' && b64input[len-2] == '=') //last two chars are =
+        padding = 2;
+    else if (b64input[len-1] == '=') //last char is =
+        padding = 1;
+     
+    return (int)len*0.75 - padding;
+}
+
+void
+base64_encode(const unsigned char *input, int length, char* b64str)
 {
@@ -48,3 +65,2 @@ /* http://www.adp-gmbh.ch/cpp/common/base64.html */
     int b64len = (length+2 - ((length+2)%3))*4/3;
-    char *b64str = new char[b64len + 1];
 
@@ -81,4 +97,2 @@ while (length--) {
     b64str[b64len] = '\0';
-
-    return b64str;
 }
@@ -90,4 +104,4 @@
 
-unsigned char *
-base64_decode(const char *input, int length, int *outlen)
+void
+base64_decode(const char *input, int length, unsigned char *output)
 {
@@ -99,3 +113,3 @@ int i = 0;
     unsigned char char_array_4[4], char_array_3[3];
-    unsigned char *output = new unsigned char[length*3/4];
+    //unsigned char *output = new unsigned char[length*3/4];
 
@@ -137,6 +151,2 @@ while (length-- && input[idx] != '=') {
     }
-
-    *outlen = r;
-
-    return output;
 }

src/util/base64.h

@@ -1,8 +0,7 @@
-#ifndef base64_h
-#define base64_h
-
 //forward declarations
-char *base64_encode(const unsigned char*, int);
-unsigned char *base64_decode(const char *input, int length, int *outlen);
 
-#endif
+int calcBase64EncodedLength(int len);
+int calcBase64DecodedLength(const char* b64input);
+
+void base64_encode(const unsigned char *input, int length, char* b64str);
+void base64_decode(const char *input, int length, unsigned char *output);

No alert changes

Improved metrics

Total package byte prevSize

196590

0.65%

No dependency changes