Hashlib

In the previous article, we talked about security issues, and documented the Hashlib routines that we will use to protect the passwords saved in SYSUAF.DAT. In this article, we will briefly look at the Hashlib code itself.

unit HashLib ;

interface

uses // UOS...
  _UOS ; // TSRB

function HASH_Hash( Index, Source, Target, Key, LResult : int64 ) : int64 ;
function HASH_Count : integer ;
function HASH_Name( Index, SRB : int64 ) : int64 ;
function HASH_Index( Name, Res : int64 ) : int64 ;
function HASH_Default : integer ;

      // Hashing algorithms...
const Hash_Plaintext = 0 ;
      Hash_MD5 = 1 ; // "Secure"
      Hash_SHA1 = 2 ; // "Secure"
      Hash_SHA224 = 3 ; // "Secure"
      Hash_SHA256 = 4 ; // Secure
      Hash_SHA384 = 5 ; // Secure
      Hash_SHA512 = 6 ; // Secure
      Hash_HMAC_MD5 = 7 ; // Secure
      Hash_HMAC_SHA1 = 8 ; // Secure
      Hash_HMAC_SHA256 = 9 ; // Secure
      Hash_HMAC_SHA512 = 10 ; // Secure
      Hash_Checksum = 11 ; // Error checking
      Hash_XOR8 = 12 ; // Error checking
      Hash_XOR16 = 13 ; // Error checking
      Hash_XOR32 = 14 ; // Error checking
      Hash_CRC16 = 15 ; // Error checking
      Hash_CRC32 = 16 ; // Error checking
      Hash_Adler32 = 17 ; // Error checking
      Hash_ELF = 18 ; // Hashtable
      Hash_Knuth = 19 ; // Hashtable

This is the interface of the Hashlib unit. The constants indicate the default hash algorithms that are provided with UOS, although additional algorithms can be provided. Hash algorithms fall into three general categories: secure, error checking, and hashtable. It should be noted that some of the secure hashes are not, in fact, secure (those with "secure" quoted). For instance, MDA was secure when it was first developed, but has since fallen prey to the increasing power of modern processors plus online databases of MDA hashes that essentially render it useless for security purposes. Similar things happened to SHA1 and SHA224. Note also that error checking and hashtable hashes are not considered secure.

Now, you may ask yourself why we would include non-secure hashes in Hashlib. The reason is that Hashlib is used for more than security. The error checking hashes, for instance, are used to verify that data has not become corrupted. And the hashtable hashes are used for data structure support (such as for dictionaries in Python). Hashlib simply collects all of these algorithms into one place. If you are concerned with security, make sure you only use a secure hash. Even the hashes that once were secure, but no longer are, may be useful in non-security-related applications.

uses // Delphi...
     Sysutils, // Lowercase

     // Fundamentals 4.00...
     cHash,

     // UOS...
     UOS_Util ;

var Hash_Algorithms : TStringList ;


function HASH_Default : integer ;

begin
    Result := Hash_SHA384 ;
end ;

The cHash unit contains the actual hash algorithms, which we will not be covering here. You can look this code up on the internet or look at it in the next UOS source release. Hash_Algorithms contains the installed hash algorithm names.

On VMS the password hashing algorithm can be chosen, but it defaults to the Purdy hash algorithm (actually several variations of it over the years). I don't have access to the code for that particular hashing scheme, so we'll choose something different for UOS. The Hash_Default service returns the index of the UOS default scheme. For now, this is hard-coded. SHA384 is, at the time of this writing, considered a secure hashing scheme. That is, it would take an unreasonable amount of time to break it using current technology. It must be understood, however, that this may not be sufficient in the future. When it happens that SHA384 is no longer considered secure, we will have to change the default to something better. Why not make the default SHA512 right now to stave off that day for longer? Because the larger the hash result, the longer the algorithm takes to run. On a single-user personal computer, this might not be a concern, but on a timesharing system or VPS - one in which many login requests happen via LOGIN or network connections - the extra time it takes to hash data with SHA512 may unacceptably impact system performance. You generally want to run the fastest hash that is secure. However, in high security installations, one may be perfectly willing to trade some performance for the additional security. It is up to the system admin to make that determination when assigning passwords to users. Granted, an admin could choose a less secure hash if desired. But UOS always defaults to a secure configuration. Thus, SHA384 is the default for now.

One other thing to note: eventually even SHA512 may become insecure. This is why UOS has an open architecture where additional algorithms can be installed in the future if/when it becomes necessary. We can never get rid of existing algorithms because any password stored with them will require us to be able to hash a value for comparison using the same hash that hashed the original password, even if we've changed the default. That is, UOS is always backwards-compatible.

function HASH_Hash( Index, Source, Target, Key, LResult : int64 ) : int64 ;

var K, S : string ;

begin
    if( ( Index < 1 ) or ( Index >= Hash_Algorithms.Count - 1 ) ) then
    begin
        Result := HASHLIB_Invalid_Hash ;
        exit ;
    end ;
    if( ( Target = 0 ) or ( Source = 0 ) ) then
    begin
        Result := HASHLIB_No_Data ;
        exit ;
    end ;
    Result := 0 ;
    S := Get_String( PSRB( Source )^ ) ;
    K := Get_String( PSRB( Key )^ ) ;
    case Index of
    .
    .
    .
    end ; // Note: plain text just falls through to here
    if( PSRB( Target ).Length < length( S ) ) then
    begin
        Result := UOSErr_Buffer_Overflow ;
        setlength( S, PSRB( Target ).Length ) ;
    end ;
    if( LResult <> 0 ) then
    begin
        PInt64( LResult )^ := length( S ) ;
    end ;
    Set_String( S, PSRB( Target )^ ) ;
end ; // HASH_Hash

This routine gets the key and data strings from the passed pointers, validates them and the passed index, and exits on error. Otherwise, the data is hashed and returned to the caller, with a check for overflow of the receiving buffer. Note that we have excluded the actual hashing code, because it dosen't really add anything. It simply makes calls to the cHash unit to do the appropriate hash. Again, you can look at the code next time we do a release, if you really want to see it.

function HASH_Count : integer ;

begin
    Result := Hash_Algorithms.Count ;
end ;

The count of hashing algorithms matches the count of items in the Hash_Algorithms list, since it is non-sparse.

function HASH_Name( Index, SRB : int64 ) : int64 ;

var S : string ;

begin
    if( Index = 0 ) then
    begin
        Result := HASHLIB_Invalid_Hash ;
        exit ;
    end ;
    Index := Pinteger( pointer( Index ) )^ ;
    if( ( Index < 0 ) or ( Index >= Hash_Algorithms.Count - 1 ) ) then
    begin
        Result := HASHLIB_Invalid_Hash ;
        exit ;
    end ;
    Result := 0 ;
    S := Hash_Algorithms[ Index ] + #0 ;
    if( PSRB( Target ).Length < length( S ) ) then
    begin
        Result := UOSErr_Buffer_Overflow ;
        setlength( S, PSRB( Target ).Length ) ;
    end ;
    Set_String( S, PSRB( SRB )^ ) ;
end ;

This sevice returns the algorithm name for a given index. If no pointer to an index is passed, we exit with an error. If the index given is outside of the valid range we also exit with an error. Otherwise we grab the name from the string list, append a null, and then write it to the destination buffer passed to us - preventing any overflow if necessary (and returning a warning if there would have been an overflow).

function HASH_Index( Name, Res : int64 ) : int64 ;

var I : integer ;
    S : string ;

begin
    if( Name = 0 ) then
    begin
        Result := HASHLIB_Invalid_Hash ;
        exit ;
    end ;
    Result := 0 ;
    S := lowercase( Get_String( PSRB( Name )^ ) ) ;
    for I := 1 to Hash_Count - 1 do
    begin
        if( S = lowercase( Hash_Algorithms[ I ] ) ) then
        begin
            move( I, PInteger( Res )^, sizeof( I ) ) ;
            exit ;
        end ;
    end ;
    Result := HASHLIB_Invalid_Hash ;
end ;

This service does the inverse of the previous service: it returns the index for a given algorithm name.

In the next article, we will finish up our coverage of the Authorize utility.