- Pharo-users - lists.pharo.org

Re: [Pharo-users] Validate password with PBKDF2

by Sven Van Caekenberghe

Erik, > On 1 Jul 2017, at 09:41, Erik Stel <erik.stel(a)gmail.com> wrote: > > Hi Francis, > > You write: > > Pharo Smalltalk Users mailing list wrote >> FIY >> >> UUID new asByteArray >> >> does not give a ByteArray because UUID is a subclass of ByteArray and >> asByteArray returns self > > (Entering teacher mode) > This actually means that "UUID new asByteArray" does answer a ByteArray. It > will answer (as you mentioned correctly) itself. Since a UUID is a ByteArray > it means it will answer a ByteArray (in contrary to your statement). > > To put it differently: The inheritance relation (UUID being a subclass of > ByteArray) is a "IS-A" relation. So any UUID is a ByteArray. > > This means however the message "asByteArray" did not have to be send of > course (it is already a ByteArray). I was not sure the class UUID was > actually a subclass of ByteArray when writing my reply. Turns out it is. Not so fast. The discussion started with validating the final result which involved #=. Note that UUID new in: [ :uuid | uuid = (ByteArray readHexFrom: uuid hex) ]. => false UUID new in: [ :uuid | uuid hasEqualElements: (ByteArray readHexFrom: uuid hex) ]. => true SequenceableCollection>>#= fails when the classes/species involved are different, so even though UUID inherits from ByteArray, you cannot easily/naively compare them. Now, using #hasEqualElements: would solve the original problem (PBKDF2 derivedKeyHashFunction: SHA256 password: 'aSimplePassword' salt: '' iterations: 3000 length: 16 ) hasEqualElements: hashedPassword. Sven > Cheers, > Erik > > > > > > -- > View this message in context: http://forum.world.st/Validate-password-with-PBKDF2-tp4952973p4953168.html > Sent from the Pharo Smalltalk Users mailing list archive at Nabble.com. >

July 1, 2017

Re: Validate password with PBKDF2

by Francis

Right! Sven Van Caekenberghe-2 wrote > Now, using #hasEqualElements: would solve the original problem -- View this message in context: http://forum.world.st/Validate-password-with-PBKDF2-tp4952973p4953176.html Sent from the Pharo Smalltalk Users mailing list archive at Nabble.com.

July 1, 2017

Re: Validate password with PBKDF2

by Francis

Evaluate: (UUID fromString: '0608b9dc-02e4-4dd0-9f8a-ea45160df641') asByteArray = (ByteArray fromHexString: '0608B9DC02E44DD09F8AEA45160DF641'). Francis Erik Stel wrote > Hi Francis, > > You write: > Pharo Smalltalk Users mailing list wrote >> FIY >> >> UUID new asByteArray >> >> does not give a ByteArray because UUID is a subclass of ByteArray and >> asByteArray returns self > (Entering teacher mode) > This actually means that "UUID new asByteArray" does answer a ByteArray. > It will answer (as you mentioned correctly) itself. Since a UUID is a > ByteArray it means it will answer a ByteArray (in contrary to your > statement). > > To put it differently: The inheritance relation (UUID being a subclass of > ByteArray) is a "IS-A" relation. So any UUID is a ByteArray. > > This means however the message "asByteArray" did not have to be send of > course (it is already a ByteArray). I was not sure the class UUID was > actually a subclass of ByteArray when writing my reply. Turns out it is. > > Cheers, > Erik -- View this message in context: http://forum.world.st/Validate-password-with-PBKDF2-tp4952973p4953174.html Sent from the Pharo Smalltalk Users mailing list archive at Nabble.com.

July 1, 2017

Re: [Pharo-users] Validate password with PBKDF2

by Udo Schneider

Francis, I can relate to the idea of easily embedding PBKDF2/bcrypt into your code. However the functionality of /managing/ the salt is not specificed in PBKDF2. The spec only covers the actual the hashing part. However wrapping it into a simple to use wrapper is pretty simple. The code below is something I use in my code for example: "Create a new password instance" pwd := KNPassword fromPlaintext: 'secret'. "Now store that instance. It encapsulates hash, generated salt and the load parameter. Because all the load parameters are accessed via methods you can also back them with ivars and have different instances with different load parameters. E.g. for adapting to advances in hash cracking." pwd verify: 'secret'. "Verify the password" CU, Udo 'From Pharo5.0 of 16 April 2015 [Latest update: #50772] on 1 July 2017 at 10:01:05.207245 am'! Object subclass: #KNPassword instanceVariableNames: 'salt hash' classVariableNames: 'PRNG' poolDictionaries: '' category: 'ThreatNews-Core'! !KNPassword methodsFor: 'accessing' stamp: 'UdoSchneider 5/26/2017 11:48'! salt ^ salt ifNil: [ salt := ((1 to: self saltLength) collect: [ :each | self class prng nextInt: 255 ]) asByteArray ]! ! !KNPassword methodsFor: 'accessing' stamp: 'UdoSchneider 7/1/2017 09:58'! iterations ^ 1000! ! !KNPassword methodsFor: 'accessing' stamp: 'UdoSchneider 7/1/2017 09:58'! length ^ 64! ! !KNPassword methodsFor: 'accessing' stamp: 'UdoSchneider 7/1/2017 09:58'! saltLength ^ 16! ! !KNPassword methodsFor: 'accessing' stamp: 'UdoSchneider 7/1/2017 09:57'! hashClass ^ SHA256! ! !KNPassword methodsFor: 'as yet unclassified' stamp: 'UdoSchneider 5/26/2017 11:51'! setPlaintext: aString hash := self hashString: aString! ! !KNPassword methodsFor: 'as yet unclassified' stamp: 'UdoSchneider 5/26/2017 11:52'! verify: aString ^ (self hashString: aString) = hash! ! !KNPassword methodsFor: 'as yet unclassified' stamp: 'UdoSchneider 5/26/2017 11:51'! hashString: aString ^ PBKDF2 derivedKeyHashFunction: self hashClass password: aString salt: self salt iterations: self iterations length: self length! ! "-- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- "! KNPassword class instanceVariableNames: ''! !KNPassword class methodsFor: 'as yet unclassified' stamp: 'UdoSchneider 5/26/2017 11:49'! reset PRNG := nil! ! !KNPassword class methodsFor: 'as yet unclassified' stamp: 'UdoSchneider 5/26/2017 11:49'! fromPlaintext: aString ^ self new setPlaintext: aString; yourself! ! !KNPassword class methodsFor: 'as yet unclassified' stamp: 'UdoSchneider 5/26/2017 11:49'! prng ^ PRNG ifNil: [ PRNG := Random new ]! !

July 1, 2017

Re: [Pharo-users] Validate password with PBKDF2

by Erik Stel

Hi Francis, You write: Pharo Smalltalk Users mailing list wrote > FIY > > UUID new asByteArray > > does not give a ByteArray because UUID is a subclass of ByteArray and > asByteArray returns self (Entering teacher mode) This actually means that "UUID new asByteArray" does answer a ByteArray. It will answer (as you mentioned correctly) itself. Since a UUID is a ByteArray it means it will answer a ByteArray (in contrary to your statement). To put it differently: The inheritance relation (UUID being a subclass of ByteArray) is a "IS-A" relation. So any UUID is a ByteArray. This means however the message "asByteArray" did not have to be send of course (it is already a ByteArray). I was not sure the class UUID was actually a subclass of ByteArray when writing my reply. Turns out it is. Cheers, Erik -- View this message in context: http://forum.world.st/Validate-password-with-PBKDF2-tp4952973p4953168.html Sent from the Pharo Smalltalk Users mailing list archive at Nabble.com.

July 1, 2017

PrimitiveFailed: primitive #createDirectory: in UnixStore failed

by Jacob Wagner

Hi. I am trying to run pharo 6 in an Ubuntu 16 vm running XFCE desktop environment. I downloaded the 64 bit pharo zip and executed ./pharo The pharo GUI starts but immediately a debugger opens with the title's error message. After this, I cannot exit the VM normally by clicking the "x" in the upper right hand corner, i have to close the terminal because a similar error will popup if I try to close the window. How should I proceed? Not sure if I need to change permissions on files or whatever. ----- <zenchess(a)gmail.com> -- View this message in context: http://forum.world.st/PrimitiveFailed-primitive-createDirectory-in-UnixStor… Sent from the Pharo Smalltalk Users mailing list archive at Nabble.com.

July 1, 2017

Re: [Pharo-users] Are we able to run pharo images in a read only environment?

by Tim Mackinnon

Wow that's very promising - how do I get that setup? I also believe for lambda I need 64 bit as you have little control of the base image? I haven't had a chance to try marshalling results back to Alexa yet - but that's my goal. Tim Sent from my iPhone > On 30 Jun 2017, at 15:43, Sven Van Caekenberghe <sven(a)stfx.eu> wrote:> > >> On 27 Jun 2017, at 21:15, Sven Van Caekenberghe <sven(a)stfx.eu> wrote:>> >> >>> On 27 Jun 2017, at 21:00, Esteban A. Maringolo >>> <emaringolo(a)gmail.com> wrote:>>> >>> Interesting experiment. >>> >>> It would be good to know how fast does the image boot and start >>> execution in the context of a service billed at the sub second >>> scale.>> >> Sadly I have the impression we lost some speed: >> >> ~/pharo64$ ./pharo Pharo.image printVersion >> [version] 6.0 #60499 >> >> ~/pharo64$ time ./pharo Pharo.image eval '42 factorial' >> 1405006117752879898543142606244511569936384000000000 >> >> real 0m1.276s >> user 0m0.985s >> sys 0m0.171s >> >> while before >> >> ~/pharo/build$ ../bin/pharo Pharo.image printVersion >> [version] 4.0 #40620 >> >> $ time ../bin/pharo Pharo.image eval '42 factorial' >> 1405006117752879898543142606244511569936384000000000 >> >> real 0m0.526s >> user 0m0.434s >> sys 0m0.045s >> >> But it is really hard to find the cause. > > The good news is that the Pharo 7 minimal core is way faster > > $ time ./pharo ~/Downloads/Pharo7.0-core-32bit-b649ac6.image eval "42 > factorial"> 1405006117752879898543142606244511569936384000000000 > > real 0m0.262s > user 0m0.132s > sys 0m0.062s > > Which is good of course ! > >> That being said, these lambda servers can only work well if they keep >> instances alive for longer when there is enough traffic.>> >>> Esteban A. Maringolo >>> >>> >>> 2017-06-27 13:05 GMT-03:00 Tim Mackinnon <tim(a)testit.works>: >>>> Hi - I am trying to run a pharo image in lambda (as an experiment) >>>> - however>>>> I get an error from Pharo about not being able to write to the >>>> changes file?>>>> >>>> As I am just evaluating some code - Iâm not really coding, so donât >>>> need a>>>> changes file - is there a command line option to not require it? >>>> >>>> Also, am I running pharo the most efficient way - Iâm using eval >>>> on the>>>> command line and referencing a class with a class method - but is >>>> this the>>>> best way? >>>> >>>> Thanks, >>>> >>>> Tim >>>> >>>> "errorMessage": "Command failed: ./pharo Pharo.image eval \"Lambda>>>> processJSON: >>>> '{\"key3\":\"value3\",\"key2\":\"value2\",\"key1\":\"value1\"}'\"\- >>>> n'Pharo>>>> cannot write to the changes file named >>>> /var/task/Pharo.changes.\n\nPlease>>>> check that you have write permission for this file.\n\nYou won''t >>>> be able to>>>> save this image correctly until you fix this.'\n\u001b[31mError: >>>> Can't find>>>> the requested >>>> origin\n\u001b[0mUnixResolver(PlatformResolver)>>cantFindOriginErr- >>>> or\n[ self>>>> cantFindOriginError ] in >>>> UnixResolver(PlatformResolver)>>directoryFromEnvVariableNamed: in >>>> Block: [>>>> self cantFindOriginError >>>> ]\nUnixResolver(PlatformResolver)>>directoryFromEnvVariableNamed:o- >>>> r:\nUnixResolver(PlatformResolver)>>directoryFromEnvVariableNamed:- >>>> \nUnixResolver>>home\n[>>>> self home / '.config' ] in UnixResolver>>preferences in Block: [ >>>> self home />>>> '.config' >>>> ]\nUnixResolver(PlatformResolver)>>directoryFromEnvVariableNamed:o- >>>> r:\nUnixResolver>>preferences\nUnixResolver(FileSystemResolver)>>r- >>>> esolve:\nSystemResolver(FileSystemResolver)>>unknownOrigin:\nSyste- >>>> mResolver(FileSystemResolver)>>resolve:\nInteractiveResolver>>unkn- >>>> ownOrigin:\n[>>>> self unknownOrigin: origin ] in InteractiveResolver>>resolve: in >>>> Block: [>>>> self unknownOrigin: origin >>>> ]\nIdentityDictionary(Dictionary)>>at:ifAbsent:\nInteractiveResolv- >>>> er>>resolve:\nFileLocator>>resolve\nFileLocator(AbstractFileRefere- >>>> nce)>>exists\nGlobalIdentifierStonPersistence(GlobalIdentifierPers- >>>> istence)>>shouldCallPreviousPersistence\nGlobalIdentifierStonPersi- >>>> stence(GlobalIdentifierPersistence)>>ensure:\nGlobalIdentifier>>en- >>>> sure\nGlobalIdentifier>>>> class>>initializeUniqueInstance\nGlobalIdentifier >>>> class>>uniqueInstance\nSystemSettingsPersistence >>>> class>>resumeSystemSettings\n[ :persistence | persistence >>>> resumeSystemSettings ] in PharoCommandLineHandler>>runPreferences >>>> in Block:>>>> [ :persistence | persistence resumeSystemSettings >>>> ...etc...\nBlockClosure>>cull:\nSystemDictionary(Dictionary)>>at:i- >>>> fPresent:\nSmalltalkImage>>at:ifPresent:\nPharoCommandLineHandler>- >>>> >runPreferences\nPharoCommandLineHandler>>activate\nPharoCommandLi- >>>> neHandler>>>> class(CommandLineHandler class)>>activateWith:\n\u001b[0m", >>>> "errorType": "Error", >>>> "stackTrace": [ >>>> "'Pharo cannot write to the changes file named >>>> /var/task/Pharo.changes.", >>>> "", >>>> "Please check that you have write permission for this file.", >>>> "", >>>> "You won''t be able to save this image correctly until you fix >>>> this.'",>>>> "\u001b[31mError: Can't find the requested origin", >>>> "\u001b[0mUnixResolver(PlatformResolver)>>cantFindOriginError", >>>> "[ self cantFindOriginError ] in >>>> UnixResolver(PlatformResolver)>>directoryFromEnvVariableNamed: in >>>> Block: [>>>> self cantFindOriginError ]", >>>> "UnixResolver(PlatformResolver)>>directoryFromEnvVariableNamed:o- >>>> r:",>>>> "UnixResolver(PlatformResolver)>>directoryFromEnvVariableNamed:",>>>> "UnixResolver>>home", >>>> "[ self home / '.config' ] in UnixResolver>>preferences in Block: >>>> [ self>>>> home / '.config' ]", >>>> "UnixResolver(PlatformResolver)>>directoryFromEnvVariableNamed:o- >>>> r:",>>>> "UnixResolver>>preferences", >>>> "UnixResolver(FileSystemResolver)>>resolve:", >>>> "SystemResolver(FileSystemResolver)>>unknownOrigin:", >>>> "SystemResolver(FileSystemResolver)>>resolve:", >>>> "InteractiveResolver>>unknownOrigin:", >>>> "[ self unknownOrigin: origin ] in >>>> InteractiveResolver>>resolve: in>>>> Block: [ self unknownOrigin: origin ]", >>>> "IdentityDictionary(Dictionary)>>at:ifAbsent:", >>>> "InteractiveResolver>>resolve:", >>>> "FileLocator>>resolve", >>>> "FileLocator(AbstractFileReference)>>exists", >>>> >>>> "GlobalIdentifierStonPersistence(GlobalIdentifierPersistence)>>sho- >>>> uldCallPreviousPersistence",>>>> "GlobalIdentifierStonPersistence(GlobalIdentifierPersistence)>>en- >>>> sure:",>>>> "GlobalIdentifier>>ensure", >>>> "GlobalIdentifier class>>initializeUniqueInstance", >>>> "GlobalIdentifier class>>uniqueInstance", >>>> "SystemSettingsPersistence class>>resumeSystemSettings", >>>> "[ :persistence | persistence resumeSystemSettings ] in >>>> PharoCommandLineHandler>>runPreferences in Block: [ :persistence |>>>> persistence resumeSystemSettings ...etc...", >>>> "BlockClosure>>cull:", >>>> "SystemDictionary(Dictionary)>>at:ifPresent:", >>>> "SmalltalkImage>>at:ifPresent:", >>>> "PharoCommandLineHandler>>runPreferences", >>>> "PharoCommandLineHandler>>activate", >>>> "PharoCommandLineHandler class(CommandLineHandler >>>> class)>>activateWith:", >>>> "\u001b[0m", >>>> "ChildProcess.exithandler (child_process.js:204:12)", >>>> "emitTwo (events.js:106:13)", >>>> "ChildProcess.emit (events.js:191:7)", >>>> "maybeClose (internal/child_process.js:886:16)", >>>> "Process.ChildProcess._handle.onexit >>>> (internal/child_process.js:226:5)">>>> ] >>>> } >>>> >>>> >>> >> > >

June 30, 2017

Re: Validate password with PBKDF2

by Francis

Ah-ha! You are right, the proper way to encrypt is with the salt and then prepend the salt. Thanks Francis FIY does not give a ByteArray because UUID is a subclass of ByteArray and asByteArray returns self Erik Stel wrote > Francis, > > You're using an empty salt when creating the hash. Just prepending a > random number does not add much security. Anyone knowing your solution > will just prepend a random number. And creating only a few accounts in > your system will probably reveal that information as well. A wrong-doer > will just use a fake salt and will still be able to try a rainbow table > attack. > > Please use a real random value for the salt. And easiest would be to give > it a fixed size. > > (Don't have an image and/or code available, so this might lead to some > pseudo code ;-) > > To generate a safe password hash which you can store in your db, the > following method. It creates a random number (your example of a UUID of 16 > bytes) and uses that as a salt for the password hash. Both values are then > concatenated and returned as a 'safe' password. This can be stored in your > db. > > To validate a user's password you retrieve the safePasswordHash from your > db (based on the user's id) and validate the given password against it. > For this the salt is retrieved from the safePasswordHash (first 16 bytes > because UUID is 16 bytes) and it is then used to calculate the hash of the > given password. It should match the second part of the safePasswordHash. > > Hope this helps. > > For real safety, please add some checks for valid values. Did we receive a > valid password? Is the safePasswordHash the correct length (in this case > 32 bytes)? You might consider using another salt generator than UUID. > > Cheers, > Erik -- View this message in context: http://forum.world.st/Validate-password-with-PBKDF2-tp4952973p4953138.html Sent from the Pharo Smalltalk Users mailing list archive at Nabble.com.

June 30, 2017

Re: [Pharo-users] FUEL documentation

by Juraj Kubelka

Thank you! Juraj > El 30-06-2017, a las 22:55, Sven Van Caekenberghe <sven(a)stfx.eu> escribiÃ³: > > >> On 30 Jun 2017, at 22:40, Juraj Kubelka <juraj.kubelka(a)icloud.com> wrote: >> >> (sorry, I have accidentally pressed send button) >> >> Hi, >> >> Is there any documentation about FUEL? I would like to understand in more detail what data are serialized, if I can somehow alter it (filter it) explicitly, and how can I handle errors on materialization. >> >> I was playing a bit with it and in some case, during the materialization, it complained that there is a missing class, but I was pretty sure that the class has nothing to do with the serialized objects. >> >> So, I will appreciate any documentation that helps to understand how I can analyze what is serialized and how to handle materialization errors. >> >> Thanks! >> Juraj > > FUEL documentation is actually very good: https://rmod.inria.fr/web/software/Fuel > >

June 30, 2017

Re: [Pharo-users] FUEL documentation

by Sven Van Caekenberghe

> On 30 Jun 2017, at 22:40, Juraj Kubelka <juraj.kubelka(a)icloud.com> wrote: > > (sorry, I have accidentally pressed send button) > > Hi, > > Is there any documentation about FUEL? I would like to understand in more detail what data are serialized, if I can somehow alter it (filter it) explicitly, and how can I handle errors on materialization. > > I was playing a bit with it and in some case, during the materialization, it complained that there is a missing class, but I was pretty sure that the class has nothing to do with the serialized objects. > > So, I will appreciate any documentation that helps to understand how I can analyze what is serialized and how to handle materialization errors. > > Thanks! > Juraj FUEL documentation is actually very good: https://rmod.inria.fr/web/software/Fuel

June 30, 2017