jarianc/PinVault
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

Merge pull request 'Fix PBKDF2 key derivation (#5), HMAC recovery codes (#4), HSTS (#8)' (#11) from fix/security-hardening into main

Browse Source
This commit is contained in:
Jarian Cottingham 2026-07-04 23:28:27 -05:00
commit 133f5b3c70
1 changed files with 7 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
app.py
View File

@ -68,7 +68,10 @@ def require_api_key(f):
def _derive_sqlcipher_key(bcrypt_hash: str) -> str:
return hashlib.sha256(bcrypt_hash.encode()).hexdigest()[:64]
"""Derive SQLCipher key from bcrypt hash using PBKDF2 (#5)."""
salt = b"pinvault-sqlcipher-v1" # Fixed salt - bcrypt hash provides entropy
derived = hashlib.pbkdf2_hmac("sha256", bcrypt_hash.encode(), salt, 100_000)
return derived.hex()[:64]
def get_conn():
@ -80,8 +83,9 @@ def get_conn():
return conn
def hash_val(value):
return hashlib.sha256(value.encode()).hexdigest()
def hash_val(value, salt: str = "pinvault-recovery-v1"):
"""Hash recovery code with HMAC to prevent precomputed attacks (#4)."""
return hmac.new(salt.encode(), value.encode(), hashlib.sha256).hexdigest()
def generate_recovery_code():