From bfe1f488d466d5a7513c6517d56a0382fb7d0e61 Mon Sep 17 00:00:00 2001 From: jelhan Date: Thu, 29 Oct 2015 12:48:46 +0100 Subject: [PATCH] remove proof key knowledge cause it's not secure implemented yet --- api/classes/model.php | 77 ------------------- api/classes/poll.php | 2 - api/index.php | 6 -- api/tests/api/CreateAnotherUserCept.php | 3 - api/tests/api/CreatePollCept.php | 12 --- api/tests/api/CreateUserCept.php | 3 - ...rFailsIfKeyKnowledgeHeaderIsNotSetCept.php | 29 ------- ...UserFailsIfKeyKnowledgeIsNotProvedCept.php | 30 -------- app/adapters/application.js | 7 -- app/services/encryption.js | 7 -- 10 files changed, 176 deletions(-) delete mode 100644 api/tests/api/CreateUserFailsIfKeyKnowledgeHeaderIsNotSetCept.php delete mode 100644 api/tests/api/CreateUserFailsIfKeyKnowledgeIsNotProvedCept.php diff --git a/api/classes/model.php b/api/classes/model.php index 511a872..0997fab 100644 --- a/api/classes/model.php +++ b/api/classes/model.php @@ -3,7 +3,6 @@ class Model { const ENCRYPTED_PROPERTIES = []; const PLAIN_PROPERTIES = []; - const PROOF_KEY_KNOWLEDGE = 'validate'; const SERVER_PROPERTIES = []; protected $data; @@ -18,13 +17,6 @@ class Model { throw new Exception('DATA_FOLDER (' . DATA_FOLDER . ') is not writeable'); } - if ( - static::PROOF_KEY_KNOWLEDGE !== 'save' && - static::PROOF_KEY_KNOWLEDGE !== 'validate' - ) { - throw new Exception('PROOF_KEY_KNOWLEDGE must be "save" or "validate" but is ' . static::PROOF_KEY_KNOWLEDGE); - } - $this->data = new stdClass(); } @@ -111,10 +103,6 @@ class Model { throw new Exception ('getPath must be implemented by model'); } - private function getPathToKeyKnowledgeFile() { - return $this->getPollDir() . 'key_knowledge'; - } - /* * Checks if a json string is a proper SJCL encrypted message. * False if format is incorrect. @@ -200,10 +188,6 @@ class Model { } } - if (static::PROOF_KEY_KNOWLEDGE === 'save') { - $model->restoreKeyKnowledge($data); - } - if (method_exists($model, 'restoreHook')) { if ($model->restoreHook() === false) { return false; @@ -213,34 +197,11 @@ class Model { return $model; } - private function restoreKeyKnowledge() { - try { - $data = file_get_contents( - $this->getPathToKeyKnowledgeFile() - ); - - if ($data) { - return $data; - } - else { - throw new Exception('key knowledge file could not be read'); - } - } - catch (Exception $e) { - return false; - } - } - /* * save object to storage * gives back new id */ public function save() { - // proof key knowledge before save - if (static::PROOF_KEY_KNOWLEDGE === 'validate') { - $this->validateKeyKnowledge(); - } - // create dir for data if it does not exists $counter = 0; while (true) { @@ -284,47 +245,9 @@ class Model { // successfully run break; } - - // save key knowledge after poll is saved - if (static::PROOF_KEY_KNOWLEDGE === 'save') { - $this->saveKeyKnowledge(); - } - } - - private function saveKeyKnowledge() { - if ( - file_put_contents( - $this->getPathToKeyKnowledgeFile(), - $this->proofKeyKnowledge, - LOCK_EX - ) === false - ) { - throw new Exception('failed to save key knowledge'); - } } private function set($key, $value) { $this->data->$key = $value; } - - public function setProofKeyKnowledge($value) { - $this->proofKeyKnowledge = $value; - } - - private function validateKeyKnowledge() { - if (empty($this->proofKeyKnowledge)) { - throw new Exception('proof key knowledge is not set'); - } - - $keyKnowledge = $this->restoreKeyKnowledge(); - - if ( - $keyKnowledge !== false && - $keyKnowledge !== $this->proofKeyKnowledge - ) { - throw new Exception( - 'key knowledge not proofed: ' . $this->proofKeyKnowledge . ' does not equal ' . var_export($keyKnowledge, true) - ); - } - } } diff --git a/api/classes/poll.php b/api/classes/poll.php index e097002..f08c1f2 100644 --- a/api/classes/poll.php +++ b/api/classes/poll.php @@ -26,8 +26,6 @@ class Poll extends model { 'version' ]; - const PROOF_KEY_KNOWLEDGE = 'save'; - const SERVER_PROPERTIES = [ 'serverExpirationDate' ]; diff --git a/api/index.php b/api/index.php index 93b3361..d2a1ae9 100644 --- a/api/index.php +++ b/api/index.php @@ -55,9 +55,6 @@ $app->post('/polls', function() use ($app) { $app->request->getBody() )->poll ); - $poll->setProofKeyKnowledge( - $app->request->headers->get('X-Croodle-Proof-Key-Knowledge') - ); $poll->save(); $app->response->setBody( @@ -75,9 +72,6 @@ $app->post('/users', function() use ($app) { $app->request->getBody() )->user ); - $user->setProofKeyKnowledge( - $app->request->headers->get('X-Croodle-Proof-Key-Knowledge') - ); $user->save(); $app->response->setBody( diff --git a/api/tests/api/CreateAnotherUserCept.php b/api/tests/api/CreateAnotherUserCept.php index 5a0d604..0355fbd 100644 --- a/api/tests/api/CreateAnotherUserCept.php +++ b/api/tests/api/CreateAnotherUserCept.php @@ -1,7 +1,6 @@ wantTo('create a user'); -$I->haveHTTPHeader('X-Croodle-Proof-Key-Knowledge', $proofKeyKnowledge); $I->sendPOST('/users', $userJson); $I->seeResponseCodeIs(200); $I->seeResponseIsJson(); diff --git a/api/tests/api/CreatePollCept.php b/api/tests/api/CreatePollCept.php index 736ec2f..02c4bf8 100644 --- a/api/tests/api/CreatePollCept.php +++ b/api/tests/api/CreatePollCept.php @@ -1,11 +1,9 @@ wantTo('create a poll'); -$I->haveHTTPHeader('X-Croodle-Proof-Key-Knowledge', $proofKeyKnowledge); $I->sendPOST('/polls', $pollJson); $I->seeResponseCodeIs(200); $I->seeResponseIsJson(); @@ -42,13 +40,3 @@ $I->dontSeeResponseJsonMatchesJsonPath( 'poll.serverExpirationDate', 'serverExpirationDate is not in response payload.' ); -$I->dontSeeResponseJsonMatchesJsonPath( - 'poll.proofKeyKnowledge', - 'proofKeyKnowledge is not in response payload.' -); - -\PHPUnit_Framework_Assert::assertEquals( - file_get_contents(TEST_DATA_DIR . $pollId . '/key_knowledge'), - $proofKeyKnowledge, - 'user array should be empty' -); diff --git a/api/tests/api/CreateUserCept.php b/api/tests/api/CreateUserCept.php index 0aff8d0..8c0855f 100644 --- a/api/tests/api/CreateUserCept.php +++ b/api/tests/api/CreateUserCept.php @@ -1,6 +1,5 @@ wantTo('create a user'); -$I->haveHTTPHeader('X-Croodle-Proof-Key-Knowledge', $proofKeyKnowledge); $I->sendPOST('/users', $userJson); $I->seeResponseCodeIs(200); $I->seeResponseIsJson(); diff --git a/api/tests/api/CreateUserFailsIfKeyKnowledgeHeaderIsNotSetCept.php b/api/tests/api/CreateUserFailsIfKeyKnowledgeHeaderIsNotSetCept.php deleted file mode 100644 index 4f30de9..0000000 --- a/api/tests/api/CreateUserFailsIfKeyKnowledgeHeaderIsNotSetCept.php +++ /dev/null @@ -1,29 +0,0 @@ -wantTo('see that create a new user fails if key knowledge header is not set'); -$I->sendPOST('/users', $userJson); -$I->seeResponseCodeIs(500); -$I->seeResponseEquals(''); - -try { - $result = file_get_contents($usersDir . '0'); -} -catch (Exception $e) { - $result = false; -} -\PHPUnit_Framework_Assert::assertFalse( - $result, - 'no user is saved to disc' -); diff --git a/api/tests/api/CreateUserFailsIfKeyKnowledgeIsNotProvedCept.php b/api/tests/api/CreateUserFailsIfKeyKnowledgeIsNotProvedCept.php deleted file mode 100644 index e8f64b3..0000000 --- a/api/tests/api/CreateUserFailsIfKeyKnowledgeIsNotProvedCept.php +++ /dev/null @@ -1,30 +0,0 @@ -wantTo('see that create a new user fails if key knowledge is wrong'); -$I->haveHTTPHeader('X-Croodle-Proof-Key-Knowledge', $wrongKeyKnowledge); -$I->sendPOST('/users', $userJson); -$I->seeResponseCodeIs(500); -$I->seeResponseEquals(''); - -try { - $result = file_get_contents($usersDir . '0'); -} -catch (Exception $e) { - $result = false; -} -\PHPUnit_Framework_Assert::assertFalse( - $result, - 'no user is saved to disc' -); diff --git a/app/adapters/application.js b/app/adapters/application.js index 3f1d5a8..97ed0d8 100644 --- a/app/adapters/application.js +++ b/app/adapters/application.js @@ -4,13 +4,6 @@ import Ember from "ember"; export default DS.RESTAdapter.extend({ encryption: Ember.inject.service(), - // set PROOF_KEY_KNOWLEDGE header - headers: Ember.computed('encryption.hash', function() { - return { - "X-Croodle-Proof-Key-Knowledge": this.get('encryption.hash') - }; - }), - // set namespace to api.php in same subdirectory namespace: window.location.pathname diff --git a/app/services/encryption.js b/app/services/encryption.js index 630227e..dd6b9c1 100644 --- a/app/services/encryption.js +++ b/app/services/encryption.js @@ -10,13 +10,6 @@ export default Ember.Service.extend({ this.set('key', generatePassphrase(passphraseLength)); }, - // ToDo: do not send a sha256 hash of encryption key without salt to server! - hash: Ember.computed('key', function() { - return sjcl.codec.hex.fromBits( - sjcl.hash.sha256.hash(this.get('key')) - ); - }), - init() { this._super(...arguments); }