mirror of
https://github.com/neondatabase/neon.git
synced 2026-08-18 12:08:19 +00:00
Conrad Ludgate
e7a1d5de94
## Problem Password hashing for sql-over-http takes up a lot of CPU. Perhaps we can get away with temporarily caching some steps so we only need fewer rounds, which will save some CPU time. ## Summary of changes The output of pbkdf2 is the XOR of the outputs of each iteration round, eg `U1 ^ U2 ^ ... U15 ^ U16 ^ U17 ^ ... ^ Un`. We cache the suffix of the expression `U16 ^ U17 ^ ... ^ Un`. To compute the result from the cached suffix, we only need to compute the prefix `U1 ^ U2 ^ ... U15`. The suffix by itself is useless, which prevent's its use in brute-force attacks should this cached memory leak. We are also caching the full 4096 round hash in memory, which can be used for brute-force attacks, where this suffix could be used to speed it up. My hope/expectation is that since these will be in different allocations, it makes any such memory exploitation much much harder. Since the full hash cache might be invalidated while the suffix is cached, I'm storing the timestamp of the computation as a way to identity the match. I also added `zeroize()` to clear the sensitive state from the stack/heap. For the most security conscious customers, we hope to roll out OIDC soon, so they can disable passwords entirely. --- The numbers for the threadpool were pretty random, but according to our busiest region for sql-over-http, we only see about 150 unique endpoints every minute. So storing ~100 of the most common endpoints for that minute should be the vast majority of requests. 1 minute was chosen so we don't keep data in memory for too long.
78 lines
1.9 KiB
Rust
78 lines
1.9 KiB
Rust
//! Tools for client/server/stored key management.
|
|
|
|
use hmac::Mac as _;
|
|
use sha2::Digest as _;
|
|
use subtle::ConstantTimeEq;
|
|
use zeroize::Zeroize as _;
|
|
|
|
use crate::metrics::Metrics;
|
|
use crate::scram::pbkdf2::Prf;
|
|
|
|
/// Faithfully taken from PostgreSQL.
|
|
pub(crate) const SCRAM_KEY_LEN: usize = 32;
|
|
|
|
/// One of the keys derived from the user's password.
|
|
/// We use the same structure for all keys, i.e.
|
|
/// `ClientKey`, `StoredKey`, and `ServerKey`.
|
|
#[derive(Clone, Default, Eq, Debug)]
|
|
#[repr(transparent)]
|
|
pub(crate) struct ScramKey {
|
|
bytes: [u8; SCRAM_KEY_LEN],
|
|
}
|
|
|
|
impl Drop for ScramKey {
|
|
fn drop(&mut self) {
|
|
self.bytes.zeroize();
|
|
}
|
|
}
|
|
|
|
impl PartialEq for ScramKey {
|
|
fn eq(&self, other: &Self) -> bool {
|
|
self.ct_eq(other).into()
|
|
}
|
|
}
|
|
|
|
impl ConstantTimeEq for ScramKey {
|
|
fn ct_eq(&self, other: &Self) -> subtle::Choice {
|
|
self.bytes.ct_eq(&other.bytes)
|
|
}
|
|
}
|
|
|
|
impl ScramKey {
|
|
pub(crate) fn sha256(&self) -> Self {
|
|
Metrics::get().proxy.sha_rounds.inc_by(1);
|
|
Self {
|
|
bytes: sha2::Sha256::digest(self.as_bytes()).into(),
|
|
}
|
|
}
|
|
|
|
pub(crate) fn as_bytes(&self) -> [u8; SCRAM_KEY_LEN] {
|
|
self.bytes
|
|
}
|
|
|
|
pub(crate) fn client_key(b: &[u8; 32]) -> Self {
|
|
// Prf::new_from_slice will run 2 sha256 rounds.
|
|
// Update + Finalize run 2 sha256 rounds.
|
|
Metrics::get().proxy.sha_rounds.inc_by(4);
|
|
|
|
let mut prf = Prf::new_from_slice(b).expect("HMAC is able to accept all key sizes");
|
|
prf.update(b"Client Key");
|
|
let client_key: [u8; 32] = prf.finalize().into_bytes().into();
|
|
client_key.into()
|
|
}
|
|
}
|
|
|
|
impl From<[u8; SCRAM_KEY_LEN]> for ScramKey {
|
|
#[inline(always)]
|
|
fn from(bytes: [u8; SCRAM_KEY_LEN]) -> Self {
|
|
Self { bytes }
|
|
}
|
|
}
|
|
|
|
impl AsRef<[u8]> for ScramKey {
|
|
#[inline(always)]
|
|
fn as_ref(&self) -> &[u8] {
|
|
&self.bytes
|
|
}
|
|
}
|