Feature #73164

Add crypto-safe hashing API

Added by Christian Futterlieb over 3 years ago. Updated about 1 year ago.

Status:
Rejected
Priority:
Should have
Assignee:
-
Category:
-
Target version:
-
Start date:
2016-02-06
Due date:
% Done:

0%

PHP Version:
Tags:
Complexity:
Sprint Focus:

Description

This is my second task for equipping TYPO3 with some crypto-related code (see also #73050).

I'd like to introduce a crypto-safe hashing API into TYPO3 core. As the hashing features of PHP are strong related to security features, it seems crucial to have it done right (on the backside) and with an easy to use interface.

The proposed change should contain the following:
  • Create API in Crypto\Hash
  • Deprecate GeneralUtility::hmac()
  • Adopt the new API

Interface description:

namespace TYPO3\CMS\Core\Crypto;
class Hash
{
    /* hashing methods */
    public static function hash($data, $rawOutput = FALSE);
    public static function hmac($data, $key = NULL, $rawOutput = FALSE);
    public static function verifyHash($correctHash, $data, $withRawOutputEnabled = FALSE);
    public static function verifyHmac($correctHash, $data, $key = null, $withRawOutputEnabled = FALSE);

    /* timing attack safe string comparison */
    public static function hashEquals($known_string, $user_string);

    /* information methods */
    public static function getHashLenght($withRawOutputEnabled = FALSE)
    public static function getSupportedAlgos();
}


Related issues

Related to TYPO3 Core - Feature #73050: Add a CSPRNG to TYPO3 Closed 2016-01-31
Duplicated by TYPO3 Core - Feature #73456: Timing attack vulnerability in Hash comparisons throughout the core Closed 2016-02-15

History

#1 Updated by Gerrit Code Review over 3 years ago

  • Status changed from New to Under Review

Patch set 1 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/46514

#2 Updated by Gerrit Code Review over 3 years ago

Patch set 2 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/46514

#3 Updated by Gerrit Code Review over 3 years ago

Patch set 3 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/46514

#4 Updated by Gerrit Code Review over 3 years ago

Patch set 4 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/46514

#5 Updated by Gerrit Code Review over 3 years ago

Patch set 5 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/46514

#6 Updated by Gerrit Code Review over 3 years ago

Patch set 6 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/46514

#7 Updated by Gerrit Code Review over 3 years ago

Patch set 7 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/46514

#8 Updated by Gerrit Code Review over 3 years ago

Patch set 8 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/46514

#9 Updated by Gerrit Code Review over 3 years ago

Patch set 9 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/46514

#10 Updated by Gerrit Code Review over 3 years ago

Patch set 10 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/46514

#11 Updated by Gerrit Code Review over 3 years ago

Patch set 11 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/46514

#12 Updated by Gerrit Code Review over 3 years ago

Patch set 12 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/46514

#13 Updated by Gerrit Code Review over 3 years ago

Patch set 13 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/46514

#14 Updated by Gerrit Code Review almost 2 years ago

Patch set 14 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/46514

#15 Updated by Gerrit Code Review almost 2 years ago

Patch set 15 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/46514

#16 Updated by Gerrit Code Review almost 2 years ago

Patch set 16 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/46514

#17 Updated by Gerrit Code Review almost 2 years ago

Patch set 17 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/46514

#18 Updated by Gerrit Code Review almost 2 years ago

Patch set 18 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/46514

#19 Updated by Gerrit Code Review almost 2 years ago

Patch set 19 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/46514

#20 Updated by Gerrit Code Review almost 2 years ago

Patch set 20 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/46514

#21 Updated by Gerrit Code Review almost 2 years ago

Patch set 21 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/46514

#22 Updated by Gerrit Code Review almost 2 years ago

Patch set 22 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/46514

#23 Updated by Gerrit Code Review over 1 year ago

Patch set 23 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/46514

#24 Updated by Christian Kuhn about 1 year ago

  • Status changed from Under Review to Rejected

Also available in: Atom PDF