diff options
Diffstat (limited to 'internal/player/hardening_password_params_test.go')
| -rw-r--r-- | internal/player/hardening_password_params_test.go | 24 |
1 files changed, 2 insertions, 22 deletions
diff --git a/internal/player/hardening_password_params_test.go b/internal/player/hardening_password_params_test.go index 4c171f1..32b399b 100644 --- a/internal/player/hardening_password_params_test.go +++ b/internal/player/hardening_password_params_test.go @@ -5,12 +5,7 @@ package player // (e.g. argon2id:1:4294967295:...) must fail the check, not request a // multi-TiB allocation that kills the process. -import ( - "crypto/sha256" - "encoding/base64" - "encoding/hex" - "testing" -) +import "testing" func TestCheckPasswordRejectsOutOfRangeArgonParams(t *testing.T) { // Enormous memory cost (0xFFFFFFFF KiB) with an otherwise well-formed @@ -33,7 +28,7 @@ func TestCheckPasswordRejectsOutOfRangeArgonParams(t *testing.T) { } } -func TestCheckPasswordAcceptsNormalAndLegacyHashes(t *testing.T) { +func TestCheckPasswordAcceptsNormalHashes(t *testing.T) { hashed, err := HashPassword("s3cret") if err != nil { t.Fatal(err) @@ -44,19 +39,4 @@ func TestCheckPasswordAcceptsNormalAndLegacyHashes(t *testing.T) { if CheckPassword("wrong", hashed) { t.Fatal("wrong password accepted") } - - // Legacy single-pass sha256 hashes must keep verifying so old accounts - // can still log in and be upgraded. - salt := []byte("sixteen-byte-slt") - sum := sha256.Sum256(append(append([]byte{}, salt...), []byte("pw")...)) - legacy := "sha256:" + base64.RawStdEncoding.EncodeToString(salt) + ":" + hex.EncodeToString(sum[:]) - if !CheckPassword("pw", legacy) { - t.Fatal("legacy sha256 hash rejected") - } - if CheckPassword("nope", legacy) { - t.Fatal("wrong password accepted against legacy sha256 hash") - } - if !NeedsRehash(legacy) { - t.Fatal("legacy sha256 hash not flagged for rehash") - } } |