McSchneidar
cf2fa796e2
Runtime and build - Move all projects to .NET 10 with SDK-style project files and a shared Directory.Build.props (WIN/LINUX, x86/x64 defines) - Load managed and unmanaged dependencies from libs/managed and libs/unmanaged through assembly and native library resolvers - Compile party modes with Roslyn instead of CodeDom - Update AppVeyor to the .NET 10 SDK and dotnet test - Download the FFmpeg and gstreamer runtimes from the dependencies repository during the build - Remove the VC++ 2015-2022 runtime check, no dependency needs it anymore Graphics and windowing - Replace the Direct3D 9 renderer with Direct3D 11 (Vortice) - Pace Direct3D 11 frames with a frame latency waitable swap chain - Move window, input and message boxes to SDL3 - Replace System.Drawing with SkiaSharp and WinForms with SDL3 and a software renderer Video and audio - Replace Acinerella with FFmpeg 8.1.3 (FFmpeg.AutoGen) - Add hardware accelerated video decoding (D3D11VA, DXVA2, VideoToolbox, VAAPI, VDPAU) with software fallback - Convert YUV video frames to RGB on the GPU in Direct3D 11 and OpenGL - Add the video options HardwareDecoding, GpuColorConversion, DecoderThreads and VideoDownscaleResolution - Update OpenAL to OpenTK 4 and NAudio recording to WasapiRecorder Fixes - Fix the song preview start and shorten the reporter buttons - Fix a crash when opening the highscore without a selected song - Use the options slide highlight in the party mode screens to avoid brightness flicker on VRR displays - Disable GameInput in the x86 build, SDL3 crashes in GameInputCreate on 32-bit systems with the GameInput runtime installed - Fix a truncation warning in PitchTracker
93 lines
2.9 KiB
C#
93 lines
2.9 KiB
C#
#region license
|
|
// This file is part of Vocaluxe.
|
|
//
|
|
// Vocaluxe is free software: you can redistribute it and/or modify
|
|
// it under the terms of the GNU General Public License as published by
|
|
// the Free Software Foundation, either version 3 of the License, or
|
|
// (at your option) any later version.
|
|
//
|
|
// Vocaluxe is distributed in the hope that it will be useful,
|
|
// but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
// GNU General Public License for more details.
|
|
//
|
|
// You should have received a copy of the GNU General Public License
|
|
// along with Vocaluxe. If not, see <http://www.gnu.org/licenses/>.
|
|
#endregion
|
|
|
|
using System.Security.Cryptography;
|
|
using System.Text;
|
|
|
|
namespace VocaluxeWeb.Services
|
|
{
|
|
/// PINs are hashed with PBKDF2 (16 byte salt). Profiles from the old webserver use a single salted SHA-256 (32 byte salt);
|
|
/// those are still accepted and upgraded on the next successful login.
|
|
public static class CPinHasher
|
|
{
|
|
private const int _SaltSize = 16;
|
|
private const int _LegacySaltSize = 32;
|
|
private const int _HashSize = 32;
|
|
private const int _Iterations = 100000;
|
|
|
|
public static void Hash(string pin, out byte[] hash, out byte[] salt)
|
|
{
|
|
salt = new byte[_SaltSize];
|
|
using (var rng = RandomNumberGenerator.Create())
|
|
{
|
|
rng.GetBytes(salt);
|
|
}
|
|
|
|
hash = _Pbkdf2(pin, salt);
|
|
}
|
|
|
|
public static bool Verify(string pin, byte[] hash, byte[] salt)
|
|
{
|
|
if (hash == null || salt == null || pin == null)
|
|
{
|
|
return false;
|
|
}
|
|
|
|
var computed = salt.Length == _LegacySaltSize ? _LegacySha256(pin, salt) : _Pbkdf2(pin, salt);
|
|
return _FixedTimeEquals(computed, hash);
|
|
}
|
|
|
|
public static bool NeedsUpgrade(byte[] salt)
|
|
{
|
|
return salt != null && salt.Length == _LegacySaltSize;
|
|
}
|
|
|
|
private static byte[] _Pbkdf2(string pin, byte[] salt)
|
|
{
|
|
return Rfc2898DeriveBytes.Pbkdf2(pin, salt, _Iterations, HashAlgorithmName.SHA256, _HashSize);
|
|
}
|
|
|
|
private static byte[] _LegacySha256(string pin, byte[] salt)
|
|
{
|
|
var password = Encoding.UTF8.GetBytes(pin);
|
|
var data = new byte[password.Length + salt.Length];
|
|
password.CopyTo(data, 0);
|
|
salt.CopyTo(data, password.Length);
|
|
using (var sha = SHA256.Create())
|
|
{
|
|
return sha.ComputeHash(data);
|
|
}
|
|
}
|
|
|
|
private static bool _FixedTimeEquals(byte[] a, byte[] b)
|
|
{
|
|
if (a.Length != b.Length)
|
|
{
|
|
return false;
|
|
}
|
|
|
|
var diff = 0;
|
|
for (var i = 0; i < a.Length; i++)
|
|
{
|
|
diff |= a[i] ^ b[i];
|
|
}
|
|
|
|
return diff == 0;
|
|
}
|
|
}
|
|
}
|