password 2.1.0.0 → 2.1.1.0

raw patch · 7 files changed

+71/−28 lines, 7 filesPVP ok

version bump matches the API change (PVP)

API changes (from Hackage documentation)

Files

• ChangeLog.md +21/−4
• password.cabal +2/−2
• src/Data/Password/Bcrypt.hs +1/−1
• src/Data/Password/PBKDF2.hs +3/−3
• src/Data/Password/Scrypt.hs +1/−1
• src/Data/Password/Validate.hs +41/−15
• test/tasty/Validate.hs +2/−2

@@ -1,5 +1,21 @@-# Changelog for password+# Changelog for `password` +## 2.1.1.0++-   Fixed `homepage` links in the `.cabal` files.+    [#34](https://github.com/cdepillabout/password/pull/34)+    Thanks to [@Radicalautistt](https://github.com/Radicalautistt)+-   Updated the `defaultPasswordPolicy` and documentation of the+    `Data.Password.Validate` module using information about research done on+    "memorized secrets" (i.e. passwords) by the NIST.+    [#31] https://github.com/cdepillabout/password/pull/31+    Thanks to [@agentultra](https://github.com/agentultra) for pointing out+    the research and starting the PR.+    [#39](https://github.com/cdepillabout/password/pull/39)+    Thanks to [@Vlix](https://github.com/Vlix) for updating the rest of the+    documentation.+-   Small spelling and other documentation fixes.+ ## 2.1.0.0  -   A new `Validate` module has been added to dictate policies that passwords@@ -8,8 +24,8 @@     Huge thanks to [@HirotoShioi](https://github.com/HirotoShioi) for picking     up the task of adding this functionality and doing most of the groundwork.     [#27](https://github.com/cdepillabout/password/pull/27)-    Thanks to Felix Paulusma ([@Vlix](https://github.com/Vlix)) for finishing-    up the API and documentation.+    Thanks to [@Vlix](https://github.com/Vlix) for finishing up the API and+    documentation.  ## 2.0.1.1 @@ -42,7 +58,8 @@     `Password -> Text`. (Anyone who needs it to be a `String` knows where to     find `Data.Text.unpack`)     [#8](https://github.com/cdepillabout/password/pull/8)--   GHC versions < 8.2 are no longer actively supported. (Tested to work for GHC 8.2.2)+-   GHC versions < 8.2 are no longer actively supported.+    (Tested to work for GHC 8.2.2)  ## 1.0.0.0 

@@ -1,11 +1,11 @@ cabal-version: 1.12  name:           password-version:        2.1.0.0+version:        2.1.1.0 category:       Data synopsis:       Hashing and checking of passwords description:    A library providing functionality for working with plain-text and hashed passwords with different types of algorithms.-homepage:       https://github.com/cdepillabout/password/password#readme+homepage:       https://github.com/cdepillabout/password/tree/master/password#readme bug-reports:    https://github.com/cdepillabout/password/issues author:         Dennis Gosnell, Felix Paulusma maintainer:     cdep.illabout@gmail.com, felix.paulusma@gmail.com

@@ -14,7 +14,7 @@ slows down the hashing speed.  It is a straightforward and easy way to get decent protection-on passwords, it is also been around long enough to be battle-tested+on passwords, it has also been around long enough to be battle-tested and generally considered to provide a good amount of security.  == Other algorithms

@@ -14,12 +14,12 @@ The PBKDF2 algorithm is one of the oldest and most solid password algorithms out there. It has also, however, been shown to be the least secure out of all major password algorithms. The main-reason for this is that is doesn't make use of any memory cost+reason for this is that it doesn't make use of any memory cost or other method of making it difficult for specialized hardware attacks, like GPU cracking attacks. -It is still, however used all over the world, since it has been-shown to be a very reliable way to encrypt passwords. Though it is+It is still, however, used all over the world, since it has been+shown to be a very reliable way to encrypt passwords. And it is most definitely better than trying to develop a password algorithm on your own, or god-forbid, not using /any/ encryption on your stored passwords.

@@ -82,7 +82,7 @@ import Data.Password.Internal (Password(..), from64, readT, showT, toBytes) import qualified Data.Password.Internal (newSalt) --- | Phantom type for __Argon2__+-- | Phantom type for __scrypt__ -- -- @since 2.0.0.0 data Scrypt

@@ -14,19 +14,40 @@  = Password Validation -It is common for passwords to have a set of requirements. For example,-a password might have to contain at least a certain amount of characters-that consist of uppercase and lowercase alphabetic characters combined with-numbers and/or other special characters.+It is common for passwords to have a set of requirements. The most obvious+requirement being a minimum length, but another common requirement is for+the password to at least include a certain amount of characters of a certain+category, like uppercase and lowercase alphabetic characters, numbers and/or+other special characters. /Though, nowadays, this last type of requirement is/+/discouraged by security experts/.  This module provides an API which enables you to set up your own 'PasswordPolicy' to validate the format of 'Password's. +== /Recommendations by the NIST/++For policy recommendations and more, look to the following publication by+the National Institute of Standards and Technology (especially the addendum):+<https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-63b.pdf>++A short summary:++* Enforcing inclusion of specific character types (like special characters,+numbers, lowercase and uppercase letters) actually makes passwords __less secure__.+* The length of a password is __the most important__ factor, so let+users make their passwords as lengthy as they want, within reason.+(keep in mind some algorithms have length limitations, like /bcrypt/'s+72 character limit)+* Do allow spaces so users can use sentences for passwords.+* Showing the "strength" of user's passwords is advised. A good algorithm+to use is /zxcvbn/.+* The best way to mitigate online attacks is to limit the rate of login attempts.+ == Password Policies  The most important part is to have a valid and robust 'PasswordPolicy'. -A 'defaultPasswordPolicy_' is provided to quickly set up a "good-enough"+A 'defaultPasswordPolicy_' is provided to quickly set up a NIST recommended validation of passwords, but you can also adjust it, or just create your own. @@ -37,9 +58,8 @@ = Example usage  So let's say we're fine with the default policy, which requires the-password to be between 8-64 characters, and have at least one lowercase,-one uppercase and one digit character, then our function would look like-the following:+password to be between 8-64 characters, and doesn't enforce any specific+character category usage, then our function would look like the following:  @ myValidateFunc :: 'Password' -> Bool@@ -292,30 +312,36 @@  -- | Default value for the 'PasswordPolicy'. ----- Enforces that a password must be between 8-64 characters long and--- have at least one uppercase letter, one lowercase letter and one digit,+-- Enforces that a password must be between 8-64 characters long, -- though can easily be adjusted by using record update syntax: -- -- @--- myPolicy = defaultPasswordPolicy{ specialChars = 1 }+-- myPolicy = defaultPasswordPolicy{ minimumLength = 12 } -- @ --+-- /Do note that this being a default policy doesn't make it a good/+-- /enough policy in every situation. The most important field, 'minimumLength',/+-- /has 8 characters as the default, because it is the bare minimum for some/+-- /sense of security. The longer the password, the more difficult it will be/+-- /to guess or brute-force, so a minimum of 12 or 16 would be advised in/+-- /a production setting./+-- -- This policy on it's own is guaranteed to be valid. Any changes made to -- it might result in 'validatePasswordPolicy' returning one or more -- 'InvalidPolicyReason's. -- -- >>> defaultPasswordPolicy--- PasswordPolicy {minimumLength = 8, maximumLength = 64, uppercaseChars = 1, lowercaseChars = 1, specialChars = 0, digitChars = 1, charSetPredicate = <FUNCTION>}+-- PasswordPolicy {minimumLength = 8, maximumLength = 64, uppercaseChars = 0, lowercaseChars = 0, specialChars = 0, digitChars = 0, charSetPredicate = <FUNCTION>} -- -- @since 2.1.0.0 defaultPasswordPolicy :: PasswordPolicy defaultPasswordPolicy = PasswordPolicy   { minimumLength = 8,     maximumLength = 64,-    uppercaseChars = 1,-    lowercaseChars = 1,+    uppercaseChars = 0,+    lowercaseChars = 0,     specialChars = 0,-    digitChars = 1,+    digitChars = 0,     charSetPredicate = defaultCharSetPredicate   } 

@@ -181,9 +181,9 @@             defaultPassword     , testProperty "prop test for charSetPredicate after TH" $ \(PredInts i) ->         let policy = $(validatePasswordPolicyTH defaultPasswordPolicy{ charSetPredicate = CharSetPredicate $ const False})-            pred = getCharSetPredicate . charSetPredicate $ fromValidPasswordPolicy policy+            p = getCharSetPredicate . charSetPredicate $ fromValidPasswordPolicy policy             c = chr i-        in pred c == (c `elem` defaultCharSet)+        in p c == (c `elem` defaultCharSet)     ]  newtype PredInts = PredInts { unPredInts :: Int } deriving (Eq, Show)