mirror of
https://github.com/dani-garcia/vaultwarden.git
synced 2026-08-30 09:06:49 -05:00
Please allow custom CLIENT_KDF_ITER_DEFAULT #818
No Assignees
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: github-starred/vaultwarden#818
Reference in New Issue
Block a user
Originally created by @julian-klode on GitHub (Sep 30, 2020).
Subject of the issue
The .env.template lists a
PASSWORD_ITERATIONSvariable, but it's not being used in the code:In
src/db/models/user.rsthe default is a constant defined asthe same default is also in the sql default value.
I found that 100 000 iterations is fairly fast, and I think 1 000 000 iterations makes a lot of sense, but I can't change it without patching and recompiling.
Your environment
Steps to reproduce
Set the variable, restart bitwarden_rs, create new vault
Expected behaviour
New vaults are created with specified number of iterations
Actual behaviour
new vaults are created with 100 000 iterations
Relevant logs
N/A
@BlackDex commented on GitHub (Sep 30, 2020):
Hello @julian-klode,
This is incorrect.
That value
PASSWORD_ITERATIONSis used when set, but only when a new user is created, not afterwards.The other value you revere to,
CLIENT_KDF_ITER_DEFAULT, is as it states the default when nothing is set.If you run the following grep you can see this.
This will run a case insensitive and recursive search.
@julian-klode commented on GitHub (Sep 30, 2020):
I restarted the server by hand with an environment where it was set to 1e6 iterations, and looked at sqlite database prior to and after account creation and new accounts were created with 1e5 iterations.
But: It seems those are different things. PASSWORD_ITERATIONS is the number of iterations we hash the (hashed) password server side, and is being used; while CLIENT_KDF_ITER_DEFAULT is the number of iterations the client hashes the password (which creates the key we are signing with I suppose).
password_iterationscolumns indeed reflectsPASSWORD_ITERATIONSsetting, whereasclient_kdf_iteris fixed at 100k and changeable via web vault.It would be nice to be able to set a different default value for the number of client iterations, as 100 000 is quite low for modern smartphones.
@julian-klode commented on GitHub (Sep 30, 2020):
FWIW, I can try my hand at this, the change should not be that hard, just replicating the logic for password_iterations for client_kdf_iter.
@julian-klode commented on GitHub (Oct 1, 2020):
Aww, dang. The web frontend submits the number of client iterations, so the default in the code is actually irrelevant. Could do some minimal setting though, that would work.
@BlackDex commented on GitHub (Oct 1, 2020):
Yea, i was thinking about that today, thought it was something the client sets, because it does this when generating the vault data on user creation.
The only thing bitwarden_rs does is prepare a user so that we can validate it if you have invites disabled.
Unfortunately this is also nothing the server returns via there policies if i'm correct, so if you want to have this fixed i think you should suggest to have this configurable upstream for self-hosted systems.
I only don't know if they are willing to add this.
@BlackDex commented on GitHub (Oct 1, 2020):
You can only change this afterwards your self via the settings tab in the web-vault.
@julian-klode commented on GitHub (Oct 1, 2020):
Yeah, let's close this, maybe I'll just patch web vault. Or really just change the value for the 4 users I have when I set them up.