Add support for encrypted second password hashes

src/action/adduser.ts

@@ -1,6 +1,6 @@
 /*
  * server component for the TimeLimit App
- * Copyright (C) 2019 - 2020 Jonas Lochmann
+ * Copyright (C) 2019 - 2022 Jonas Lochmann
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU Affero General Public License as
@@ -15,7 +15,7 @@
  * along with this program.  If not, see <https://www.gnu.org/licenses/>.
  */
 
-import { assertParentPasswordValid, ParentPassword, ParentPasswordValidationException } from '../api/schema'
+import { assertParentPasswordValid, EncryptableParentPassword, ParentPasswordValidationException } from '../api/schema'
 import { ParentAction } from './basetypes'
 import { InvalidActionParameterException } from './meta/exception'
 import { assertIdWithinFamily } from './meta/util'
@@ -26,14 +26,14 @@ export class AddUserAction extends ParentAction {
   readonly userId: string
   readonly name: string
   readonly userType: 'parent' | 'child'
-  readonly password?: ParentPassword
+  readonly password?: EncryptableParentPassword
   readonly timeZone: string
 
   constructor ({ userId, name, userType, password, timeZone }: {
     userId: string
     name: string
     userType: 'parent' | 'child'
-    password?: ParentPassword
+    password?: EncryptableParentPassword
     timeZone: string
   }) {
     super()
@@ -85,6 +85,6 @@ export interface SerializedAddUserAction {
   name: string
   userType: 'parent' | 'child'
   userId: string
-  password?: ParentPassword
+  password?: EncryptableParentPassword
   timeZone: string
 }

src/action/childchangepassword.ts

@@ -1,6 +1,6 @@
 /*
  * server component for the TimeLimit App
- * Copyright (C) 2019 - 2020 Jonas Lochmann
+ * Copyright (C) 2019 - 2022 Jonas Lochmann
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU Affero General Public License as
@@ -15,17 +15,17 @@
  * along with this program.  If not, see <https://www.gnu.org/licenses/>.
  */
 
-import { assertParentPasswordValid, ParentPassword, ParentPasswordValidationException } from '../api/schema'
+import { assertParentPasswordValid, EncryptableParentPassword, ParentPasswordValidationException } from '../api/schema'
 import { ChildAction } from './basetypes'
 import { InvalidActionParameterException } from './meta/exception'
 
 const actionType = 'ChildChangePasswordAction'
 
 export class ChildChangePasswordAction extends ChildAction {
-  readonly password: ParentPassword
+  readonly password: EncryptableParentPassword
 
   constructor ({ password }: {
-    password: ParentPassword
+    password: EncryptableParentPassword
   }) {
     super()
 
@@ -50,5 +50,5 @@ export class ChildChangePasswordAction extends ChildAction {
 
 export interface SerializedChildChangePasswordAction {
   type: 'CHILD_CHANGE_PASSWORD'
-  password: ParentPassword
+  password: EncryptableParentPassword
 }

src/action/setchildpassword.ts

@@ -1,6 +1,6 @@
 /*
  * server component for the TimeLimit App
- * Copyright (C) 2019 - 2020 Jonas Lochmann
+ * Copyright (C) 2019 - 2022 Jonas Lochmann
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU Affero General Public License as
@@ -15,7 +15,7 @@
  * along with this program.  If not, see <https://www.gnu.org/licenses/>.
  */
 
-import { assertParentPasswordValid, ParentPassword, ParentPasswordValidationException } from '../api/schema'
+import { assertParentPasswordValid, EncryptableParentPassword, ParentPasswordValidationException } from '../api/schema'
 import { ParentAction } from './basetypes'
 import { InvalidActionParameterException } from './meta/exception'
 import { assertIdWithinFamily } from './meta/util'
@@ -24,11 +24,11 @@ const actionType = 'SetChildPasswordAction'
 
 export class SetChildPasswordAction extends ParentAction {
   readonly childUserId: string
-  readonly newPassword: ParentPassword
+  readonly newPassword: EncryptableParentPassword
 
   constructor ({ childUserId, newPassword }: {
     childUserId: string
-    newPassword: ParentPassword
+    newPassword: EncryptableParentPassword
   }) {
     super()
 
@@ -60,5 +60,5 @@ export class SetChildPasswordAction extends ParentAction {
 export interface SerializedSetChildPasswordAction {
   type: 'SET_CHILD_PASSWORD'
   childId: string
-  newPassword: ParentPassword
+  newPassword: EncryptableParentPassword
 }

src/api/schema.ts

@@ -1,6 +1,6 @@
 /*
  * server component for the TimeLimit App
- * Copyright (C) 2019 - 2021 Jonas Lochmann
+ * Copyright (C) 2019 - 2022 Jonas Lochmann
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU Affero General Public License as
@@ -44,18 +44,33 @@ export interface NewDeviceInfo {
   model: string
 }
 
-export interface ParentPassword {
+export interface PlaintextParentPassword {
   hash: string
   secondHash: string
   secondSalt: string
 }
 
-export const assertParentPasswordValid = (password: ParentPassword) => {
+export interface EncryptableParentPassword {
+  hash: string
+  secondHash: string
+  secondSalt: string
+  encrypted?: boolean
+}
+
+export const assertPlaintextParentPasswordValid = (password: PlaintextParentPassword) => {
+  assertParentPasswordValid({ ...password, encrypted: false })
+}
+
+export const assertParentPasswordValid = (password: EncryptableParentPassword) => {
   if (password.hash === '' || password.secondHash === '' || password.secondSalt === '') {
     throw new ParentPasswordValidationException('missing fields at parent password')
   }
 
-  if (!(optionalPasswordRegex.test(password.hash) && optionalPasswordRegex.test(password.secondHash) && optionalSaltRegex.test(password.secondSalt))) {
+  if (!(optionalPasswordRegex.test(password.hash) && optionalSaltRegex.test(password.secondSalt))) {
+    throw new ParentPasswordValidationException('invalid parent password')
+  }
+
+  if (!password.encrypted && !optionalPasswordRegex.test(password.secondHash)) {
     throw new ParentPasswordValidationException('invalid parent password')
   }
 }
@@ -64,7 +79,7 @@ export class ParentPasswordValidationException extends Error {}
 
 export interface CreateFamilyByMailTokenRequest {
   mailAuthToken: string
-  parentPassword: ParentPassword
+  parentPassword: PlaintextParentPassword
   parentDevice: NewDeviceInfo
   deviceName: string
   timeZone: string
@@ -79,7 +94,7 @@ export interface SignIntoFamilyRequest {
 
 export interface RecoverParentPasswordRequest {
   mailAuthToken: string
-  password: ParentPassword
+  password: PlaintextParentPassword
 }
 
 export interface RegisterChildDeviceRequest {

src/api/validator.ts

@@ -124,7 +124,7 @@ const definitions = {
     },
     "additionalProperties": false
   },
-  "ParentPassword": {
+  "PlaintextParentPassword": {
     "type": "object",
     "properties": {
       "hash": {
@@ -232,7 +232,7 @@ const definitions = {
         "type": "string"
       },
       "password": {
-        "$ref": "#/definitions/ParentPassword"
+        "$ref": "#/definitions/EncryptableParentPassword"
       },
       "timeZone": {
         "type": "string"
@@ -247,6 +247,29 @@ const definitions = {
       "userType"
     ]
   },
+  "EncryptableParentPassword": {
+    "type": "object",
+    "properties": {
+      "hash": {
+        "type": "string"
+      },
+      "secondHash": {
+        "type": "string"
+      },
+      "secondSalt": {
+        "type": "string"
+      },
+      "encrypted": {
+        "type": "boolean"
+      }
+    },
+    "additionalProperties": false,
+    "required": [
+      "hash",
+      "secondHash",
+      "secondSalt"
+    ]
+  },
   "SerializedChangeParentPasswordAction": {
     "type": "object",
     "properties": {
@@ -694,7 +717,7 @@ const definitions = {
         "type": "string"
       },
       "newPassword": {
-        "$ref": "#/definitions/ParentPassword"
+        "$ref": "#/definitions/EncryptableParentPassword"
       }
     },
     "additionalProperties": false,
@@ -1931,7 +1954,7 @@ const definitions = {
         ]
       },
       "password": {
-        "$ref": "#/definitions/ParentPassword"
+        "$ref": "#/definitions/EncryptableParentPassword"
       }
     },
     "additionalProperties": false,
@@ -2787,7 +2810,7 @@ export const isCreateFamilyByMailTokenRequest: (value: unknown) => value is Crea
       "type": "string"
     },
     "parentPassword": {
-      "$ref": "#/definitions/ParentPassword"
+      "$ref": "#/definitions/PlaintextParentPassword"
     },
     "parentDevice": {
       "$ref": "#/definitions/NewDeviceInfo"
@@ -2843,7 +2866,7 @@ export const isRecoverParentPasswordRequest: (value: unknown) => value is Recove
       "type": "string"
     },
     "password": {
-      "$ref": "#/definitions/ParentPassword"
+      "$ref": "#/definitions/PlaintextParentPassword"
     }
   },
   "additionalProperties": false,

src/function/dh/decrypt.ts

@@ -0,0 +1,125 @@
+/*
+ * server component for the TimeLimit App
+ * Copyright (C) 2019 - 2022 Jonas Lochmann
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, version 3 of the License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import * as Sequelize from 'sequelize'
+import { createDecipheriv, createPrivateKey, createPublicKey, diffieHellman } from 'crypto'
+import { Database } from '../../database'
+import { calculateExpireTime } from '../../database/devicedhkey'
+import { isVersionId } from '../../util/token'
+
+export async function decrypt({
+  database, transaction, familyId, deviceId, encryptedData, authData
+}: {
+  database: Database
+  transaction: Sequelize.Transaction
+  familyId: string
+  deviceId: string
+  encryptedData: string
+  authData: Buffer
+}) {
+  const parts = encryptedData.split('.')
+
+  if (parts.length !== 3) throw new MalformedDataDecryptException('expected three parts')
+
+  const ivAndEncrypted = Buffer.from(parts[0], 'base64')
+  const otherPublicKey = Buffer.from(parts[1], 'base64')
+  const keyId = parts[2]
+
+  if (ivAndEncrypted.length < 12 + 16) throw new MalformedDataDecryptException('too short for iv and auth tag')
+
+  if (!isVersionId(keyId)) throw new KeyNotFoundDecryptException('invalid key id')
+
+  const databaseKeyEntry = await database.deviceDhKey.findOne({
+    where: {
+      familyId,
+      deviceId,
+      version: keyId
+    },
+    transaction
+  })
+
+  if (!databaseKeyEntry) throw new KeyNotFoundDecryptException('private key not found')
+
+  if (databaseKeyEntry.expireAt === null) {
+    databaseKeyEntry.expireAt = calculateExpireTime(BigInt(Date.now())).toString(10)
+    await databaseKeyEntry.save({ transaction })
+  } else {
+    if (BigInt(databaseKeyEntry.expireAt) < BigInt(Date.now())) throw new KeyExpiredDecryptException()
+  }
+
+  const privateKey = (() => {
+    try {
+      return createPrivateKey({
+        key: databaseKeyEntry.privateKey,
+        format: 'der',
+        type: 'pkcs8'
+      })
+    } catch (ex) {
+      throw new MalformedPrivateKeyException()
+    }
+  })()
+
+  const decodedOtherPublicKey = (() => {
+    try {
+      return createPublicKey({
+        key: otherPublicKey,
+        format: 'der',
+        type: 'spki'
+      })
+    } catch (ex) {
+      throw new MalformedPublicKeyException()
+    }
+  })()
+
+  const sharedSecret = (() => {
+    try {
+      return diffieHellman({
+        privateKey,
+        publicKey: decodedOtherPublicKey
+      })
+    } catch (ex) {
+      throw new MalformedNoMatchingKeysException()
+    }
+  })()
+
+  try {
+    const decipher = createDecipheriv('aes-128-gcm', sharedSecret.slice(0, 16), ivAndEncrypted.slice(0, 12), {
+      authTagLength: 16
+    })
+
+    decipher.setAuthTag(ivAndEncrypted.slice(ivAndEncrypted.length - 16, ivAndEncrypted.length))
+    decipher.setAAD(authData)
+
+    const decryptedData = Buffer.concat([
+      decipher.update(ivAndEncrypted.slice(12, ivAndEncrypted.length - 16)),
+      decipher.final()
+    ])
+
+    return decryptedData
+  } catch (ex) {
+    throw new MalformedAuthenticationException()
+  }
+}
+
+export class DecryptException extends Error {}
+class MalformedDataDecryptException extends DecryptException { constructor(message: string) { super('malformed data: ' + message) } }
+class MalformedPrivateKeyException extends DecryptException { constructor() { super('private key') } }
+class MalformedPublicKeyException extends DecryptException { constructor() { super('public key') } }
+class MalformedNoMatchingKeysException extends DecryptException { constructor() { super('no matching keys') } }
+class MalformedAuthenticationException extends DecryptException { constructor() { super('authentication data') } }
+class KeyExpiredDecryptException extends DecryptException { constructor() { super('key expired') } }
+class KeyNotFoundDecryptException extends DecryptException { constructor(message: string) { super('key not found: ' + message) } }

src/function/dh/genkey.ts

@@ -0,0 +1,38 @@
+/*
+ * server component for the TimeLimit App
+ * Copyright (C) 2019 - 2022 Jonas Lochmann
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, version 3 of the License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { generateKeyPair } from 'crypto'
+import { promisify } from 'util'
+
+const generateKeyPairAsync = promisify(generateKeyPair)
+
+export async function generateDhKeypair() {
+  return await generateKeyPairAsync(
+    'ec',
+    {
+      namedCurve: 'prime256v1',
+      publicKeyEncoding: {
+        type: 'spki',
+        format: 'der'
+      },
+      privateKeyEncoding: {
+        type: 'pkcs8',
+        format: 'der'
+      }
+    }
+  )
+}

src/function/dh/index.ts

@@ -0,0 +1,20 @@
+/*
+ * server component for the TimeLimit App
+ * Copyright (C) 2019 - 2022 Jonas Lochmann
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, version 3 of the License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+
+export { decrypt } from './decrypt'
+export { generateDhKeypair } from './genkey'
+export { decryptParentPassword } from './parentpassword'

src/function/dh/parentpassword.ts

@@ -0,0 +1,56 @@
+/*
+ * server component for the TimeLimit App
+ * Copyright (C) 2019 - 2022 Jonas Lochmann
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, version 3 of the License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { Cache } from '../sync/apply-actions/cache'
+import { ApplyActionException } from '../sync/apply-actions/exception'
+import {
+  EncryptableParentPassword, assertParentPasswordValid,
+  PlaintextParentPassword, ParentPasswordValidationException
+} from '../../api/schema'
+import { decrypt, DecryptException } from './decrypt'
+
+export async function decryptParentPassword({ cache, password } : {
+  cache: Cache
+  password: EncryptableParentPassword
+}): Promise<PlaintextParentPassword> {
+  if (!password.encrypted) return password
+
+  try {
+    const secondHash = (await decrypt({
+      database: cache.database,
+      transaction: cache.transaction,
+      familyId: cache.familyId,
+      deviceId: cache.deviceId,
+      encryptedData: password.secondHash,
+      authData: Buffer.from(`ParentPassword:${password.hash}:${password.secondSalt}`, 'ascii')
+    })).toString('ascii')
+
+    const result: PlaintextParentPassword = {
+      hash: password.hash,
+      secondSalt: password.secondSalt,
+      secondHash
+    }
+
+    assertParentPasswordValid(result)
+
+    return result
+  } catch (ex) {
+    if (ex instanceof DecryptException) throw new ApplyActionException({ staticMessage: ex.message })
+    else if (ex instanceof ParentPasswordValidationException) throw new ApplyActionException({ staticMessage: 'invalid encrypted parent password' })
+    else throw ex
+  }
+}

src/function/parent/create-family.ts

@@ -16,7 +16,7 @@
  */
 
 import { Conflict } from 'http-errors'
-import { NewDeviceInfo, ParentPassword } from '../../api/schema'
+import { NewDeviceInfo, PlaintextParentPassword, assertPlaintextParentPasswordValid } from '../../api/schema'
 import { Database } from '../../database'
 import { maxMailNotificationFlags } from '../../database/user'
 import {
@@ -29,12 +29,14 @@ export const createFamily = async ({ database, mailAuthToken, firstParentDevice,
   database: Database,
   mailAuthToken: string,
   firstParentDevice: NewDeviceInfo,
-  password: ParentPassword,
+  password: PlaintextParentPassword,
   timeZone: string,
   parentName: string,
   deviceName: string
   // no transaction here because this is directly called from an API endpoint
 }) => {
+  assertPlaintextParentPasswordValid(password)
+
   return database.transaction(async (transaction) => {
     const now = Date.now().toString(10)
     const mailInfo = await requireMailAndLocaleByAuthToken({ database, mailAuthToken, transaction, invalidate: true })

src/function/parent/recover-parent-password.ts

@@ -16,7 +16,7 @@
  */
 
 import { Conflict } from 'http-errors'
-import { ParentPassword } from '../../api/schema'
+import { PlaintextParentPassword, assertPlaintextParentPasswordValid } from '../../api/schema'
 import { Database } from '../../database'
 import { sendPasswordRecoveryUsedMail } from '../../util/mail'
 import { generateVersionId } from '../../util/token'
@@ -27,10 +27,12 @@ import { notifyClientsAboutChangesDelayed } from '../websocket'
 export const recoverParentPassword = async ({ database, websocket, password, mailAuthToken }: {
   database: Database
   websocket: WebsocketApi
-  password: ParentPassword
+  password: PlaintextParentPassword
   mailAuthToken: string
   // no transaction here because this is directly called from an API endpoint
 }) => {
+  assertPlaintextParentPasswordValid(password)
+
   await database.transaction(async (transaction) => {
     const mailInfo = await requireMailAndLocaleByAuthToken({ mailAuthToken, database, transaction, invalidate: true })
 

src/function/sync/apply-actions/cache.ts

@@ -1,6 +1,6 @@
 /*
  * server component for the TimeLimit App
- * Copyright (C) 2019 - 2020 Jonas Lochmann
+ * Copyright (C) 2019 - 2022 Jonas Lochmann
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU Affero General Public License as
@@ -27,6 +27,7 @@ import { InvalidChildActionIntegrityValue } from './exception/integrity'
 
 export class Cache {
   readonly familyId: string
+  readonly deviceId: string
   readonly hasFullVersion: boolean
   transaction: Sequelize.Transaction
   readonly database: Database
@@ -46,14 +47,16 @@ export class Cache {
   invalidiateDeviceList = false
   areChangesImportant = false
 
-  constructor ({ familyId, hasFullVersion, database, transaction, connectedDevicesManager }: {
+  constructor ({ familyId, deviceId, hasFullVersion, database, transaction, connectedDevicesManager }: {
     familyId: string
+    deviceId: string
     hasFullVersion: boolean
     database: Database
     transaction: Sequelize.Transaction
     connectedDevicesManager: VisibleConnectedDevicesManager
   }) {
     this.familyId = familyId
+    this.deviceId = deviceId
     this.hasFullVersion = hasFullVersion || config.alwaysPro
     this.database = database
     this.transaction = transaction

src/function/sync/apply-actions/dispatch-child-action/childchangepassword.ts

@@ -1,6 +1,6 @@
 /*
  * server component for the TimeLimit App
- * Copyright (C) 2019 - 2021 Jonas Lochmann
+ * Copyright (C) 2019 - 2022 Jonas Lochmann
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU Affero General Public License as
@@ -18,6 +18,7 @@
 import { ChildChangePasswordAction } from '../../../../action'
 import { Cache } from '../cache'
 import { SourceUserNotFoundException } from '../exception/illegal-state'
+import { decryptParentPassword } from '../../../dh'
 
 export const dispatchChildChangePassword = async ({ action, childUserId, cache }: {
   action: ChildChangePasswordAction
@@ -37,9 +38,11 @@ export const dispatchChildChangePassword = async ({ action, childUserId, cache }
     throw new SourceUserNotFoundException()
   }
 
-  childEntry.passwordHash = action.password.hash
-  childEntry.secondPasswordSalt = action.password.secondSalt
-  childEntry.secondPasswordHash = action.password.secondHash
+  const newPassword = await decryptParentPassword({ cache, password: action.password })
+
+  childEntry.passwordHash = newPassword.hash
+  childEntry.secondPasswordSalt = newPassword.secondSalt
+  childEntry.secondPasswordHash = newPassword.secondHash
 
   await childEntry.save({ transaction: cache.transaction })
 

src/function/sync/apply-actions/dispatch-parent-action/adduser.ts

@@ -1,6 +1,6 @@
 /*
  * server component for the TimeLimit App
- * Copyright (C) 2019 - 2020 Jonas Lochmann
+ * Copyright (C) 2019 - 2022 Jonas Lochmann
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU Affero General Public License as
@@ -16,21 +16,27 @@
  */
 
 import { AddUserAction } from '../../../../action'
+import { decryptParentPassword } from '../../../dh'
 import { Cache } from '../cache'
 
 export async function dispatchAddUser ({ action, cache }: {
   action: AddUserAction
   cache: Cache
 }) {
+  const password =
+    action.password ?
+    await decryptParentPassword({ cache, password: action.password }) :
+    null
+
   await cache.database.user.create({
     familyId: cache.familyId,
     userId: action.userId,
     type: action.userType,
     name: action.name,
     timeZone: action.timeZone,
-    passwordHash: action.password ? action.password.hash : '',
-    secondPasswordHash: action.password ? action.password.secondHash : '',
-    secondPasswordSalt: action.password ? action.password.secondSalt : '',
+    passwordHash: password ? password.hash : '',
+    secondPasswordHash: password ? password.secondHash : '',
+    secondPasswordSalt: password ? password.secondSalt : '',
     mail: '',
     disableTimelimitsUntil: '0',
     currentDevice: '',

src/function/sync/apply-actions/dispatch-parent-action/setchildpassword.ts

@@ -1,6 +1,6 @@
 /*
  * server component for the TimeLimit App
- * Copyright (C) 2019 - 2021 Jonas Lochmann
+ * Copyright (C) 2019 - 2022 Jonas Lochmann
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU Affero General Public License as
@@ -18,6 +18,7 @@
 import { SetChildPasswordAction } from '../../../../action'
 import { Cache } from '../cache'
 import { MissingUserException } from '../exception/missing-item'
+import { decryptParentPassword } from '../../../dh'
 
 export async function dispatchSetChildPassword ({ action, cache }: {
   action: SetChildPasswordAction
@@ -36,9 +37,11 @@ export async function dispatchSetChildPassword ({ action, cache }: {
     throw new MissingUserException()
   }
 
-  childEntry.passwordHash = action.newPassword.hash
-  childEntry.secondPasswordSalt = action.newPassword.secondSalt
-  childEntry.secondPasswordHash = action.newPassword.secondHash
+  const newPassword = await decryptParentPassword({ cache, password: action.newPassword })
+
+  childEntry.passwordHash = newPassword.hash
+  childEntry.secondPasswordSalt = newPassword.secondSalt
+  childEntry.secondPasswordHash = newPassword.secondHash
 
   await childEntry.save({ transaction: cache.transaction })
 

src/function/sync/apply-actions/index.ts

@@ -1,6 +1,6 @@
 /*
  * server component for the TimeLimit App
- * Copyright (C) 2019 - 2020 Jonas Lochmann
+ * Copyright (C) 2019 - 2022 Jonas Lochmann
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU Affero General Public License as
@@ -54,6 +54,7 @@ export const applyActionsFromDevice = async ({ database, request, websocket, con
       hasFullVersion: baseInfo.hasFullVersion,
       transaction,
       familyId: baseInfo.familyId,
+      deviceId: baseInfo.deviceId,
       connectedDevicesManager
     })
 

src/function/sync/get-server-data-status/dh-keys.ts

@@ -21,11 +21,8 @@ import { config, calculateExpireTime } from '../../../database/devicedhkey'
 import { ServerDhKey } from '../../../object/serverdatastatus'
 import { generateVersionId } from '../../../util/token'
 import { EventHandler } from '../../../monitoring/eventhandler'
+import { generateDhKeypair } from '../../../function/dh'
 import { FamilyEntry } from './family-entry'
-import { generateKeyPair } from 'crypto'
-import { promisify } from 'util'
-
-const generateKeyPairAsync = promisify(generateKeyPair)
 
 export async function getDeviceDhKeys ({
   database, transaction, familyEntry, deviceId, lastVersionId, eventHandler
@@ -56,20 +53,7 @@ export async function getDeviceDhKeys ({
     eventHandler.countEvent('getDeviceDhKeys:needsNewKey')
 
     const newVersion = generateVersionId()
-    const newKeypair = await generateKeyPairAsync(
-      'ec',
-      {
-        namedCurve: 'prime256v1',
-        publicKeyEncoding: {
-          type: 'spki',
-          format: 'der'
-        },
-        privateKeyEncoding: {
-          type: 'pkcs8',
-          format: 'der'
-        }
-      }
-    )
+    const newKeypair = await generateDhKeypair()
 
     if (savedData.length >= 8) {
       eventHandler.countEvent('getDeviceDhKeys:gc')

src/util/token.ts

@@ -46,5 +46,8 @@ export const assertIdWithinFamily = (id: string) => {
 }
 
 export const generateVersionId = randomString.bind(null, defaultAlphabet, 4)
+
+export const isVersionId = (id: string) => id.length === 4 && /^[a-zA-Z0-9]+$/.test(id)
+
 export const generateFamilyId = randomString.bind(null, defaultAlphabet, 10)
 export const generatePurchaseId = randomString.bind(null, defaultAlphabet, 10)