diff options
author | Wladimir J. van der Laan <laanwj@gmail.com> | 2018-11-21 10:20:41 +0100 |
---|---|---|
committer | Wladimir J. van der Laan <laanwj@gmail.com> | 2018-11-21 10:33:25 +0100 |
commit | 267793af8b03e2a11af8a51d7091495bbd065b62 (patch) | |
tree | e410cbacfd0d953a173951d8afa603e8e8ff5847 /share/rpcauth/rpcauth.py | |
parent | 6b90a2a0e06548b5c30a160fe76351a44fe3f861 (diff) | |
parent | 6be7d14d243eeeaaf6b4b98c3359c3e1695f2046 (diff) | |
download | bitcoin-267793af8b03e2a11af8a51d7091495bbd065b62.tar.xz |
Merge #14742: Properly generate salt in rpcauth.py
6be7d14d243eeeaaf6b4b98c3359c3e1695f2046 Properly generate salt in rpcauth.py, update tests (Carl Dong)
Pull request description:
Previously, when iterating over bytes of the generated salt to construct
a hex string, only one character would be outputted when the byte is
less than 0x10. Meaning that for a 16 byte salt, the hex string might be
less than 32 characters and collisions would occur.
Tree-SHA512: 7038ecbbac846cd1851112396acd8a04475685f5b6f786e4e7316acba4a56cc711c275b7f52f0f2b6bc6cfdc0c0d9d39c3afeb2c0aff3a30fde516bf642fdf9f
Diffstat (limited to 'share/rpcauth/rpcauth.py')
-rwxr-xr-x | share/rpcauth/rpcauth.py | 15 |
1 files changed, 6 insertions, 9 deletions
diff --git a/share/rpcauth/rpcauth.py b/share/rpcauth/rpcauth.py index 13bef3d37a..cecc6c30a4 100755 --- a/share/rpcauth/rpcauth.py +++ b/share/rpcauth/rpcauth.py @@ -5,17 +5,13 @@ import sys import os -from random import SystemRandom import base64 +from binascii import hexlify import hmac -def generate_salt(): - # This uses os.urandom() underneath - cryptogen = SystemRandom() - - # Create 16 byte hex salt - salt_sequence = [cryptogen.randrange(256) for _ in range(16)] - return ''.join([format(r, 'x') for r in salt_sequence]) +def generate_salt(size): + """Create size byte hex salt""" + return hexlify(os.urandom(size)).decode() def generate_password(): """Create 32 byte b64 password""" @@ -32,7 +28,8 @@ def main(): username = sys.argv[1] - salt = generate_salt() + # Create 16 byte hex salt + salt = generate_salt(16) if len(sys.argv) > 2: password = sys.argv[2] else: |