[JBoss JIRA] (LOGTOOL-124) Ability to provide exception producer
by David Lloyd (JIRA)
[ https://issues.jboss.org/browse/LOGTOOL-124?page=com.atlassian.jira.plugi... ]
David Lloyd commented on LOGTOOL-124:
-------------------------------------
I think we should probably use an annotation. That way we don't have to have too much along the lines of hand-wavy magic heuristics, especially if we add functions for other purposes in the future.
> Ability to provide exception producer
> -------------------------------------
>
> Key: LOGTOOL-124
> URL: https://issues.jboss.org/browse/LOGTOOL-124
> Project: Log Tool
> Issue Type: Feature Request
> Reporter: David Lloyd
> Assignee: James Perkins
> Priority: Minor
> Fix For: 2.1.0.Alpha3
>
>
> Sometimes you must use the same exception message for many different types of exception. It would be nice if you could give a parameter which can produce an exception, like this:
> {code}
> public interface MyLogs {
> // ...
> @Message(id = 1234, "The operation failed due to %s")
> <T extends Throwable> T operationFailed(@Producer Function<String, T> fn, String thing);
> }
> {code}
> And later at usage:
> {code}
> // ...
> throw MyLogs.log.operationFailed(IOException::new, "thingy");
> {code}
> A valid function parameter must return a type which is equal or assignable to the return type, and is assignable to Throwable. Other than that, it can be treated the same as as if you were dealing with a constructor class that has exactly one constructor, using the same matching/inference logic, meaning you could also accept BiFunction which accepts two arguments.
--
This message was sent by Atlassian JIRA
(v7.2.3#72005)
8 years, 11 months
[JBoss JIRA] (LOGTOOL-124) Ability to provide exception producer
by James Perkins (JIRA)
[ https://issues.jboss.org/browse/LOGTOOL-124?page=com.atlassian.jira.plugi... ]
James Perkins commented on LOGTOOL-124:
---------------------------------------
Do we want to use a {{@Producer}} annotation or just make assumptions if the parameter is a {{java.util.function.Function}}?
> Ability to provide exception producer
> -------------------------------------
>
> Key: LOGTOOL-124
> URL: https://issues.jboss.org/browse/LOGTOOL-124
> Project: Log Tool
> Issue Type: Feature Request
> Reporter: David Lloyd
> Assignee: James Perkins
> Priority: Minor
> Fix For: 2.1.0.Alpha3
>
>
> Sometimes you must use the same exception message for many different types of exception. It would be nice if you could give a parameter which can produce an exception, like this:
> {code}
> public interface MyLogs {
> // ...
> @Message(id = 1234, "The operation failed due to %s")
> <T extends Throwable> T operationFailed(@Producer Function<String, T> fn, String thing);
> }
> {code}
> And later at usage:
> {code}
> // ...
> throw MyLogs.log.operationFailed(IOException::new, "thingy");
> {code}
> A valid function parameter must return a type which is equal or assignable to the return type, and is assignable to Throwable. Other than that, it can be treated the same as as if you were dealing with a constructor class that has exactly one constructor, using the same matching/inference logic, meaning you could also accept BiFunction which accepts two arguments.
--
This message was sent by Atlassian JIRA
(v7.2.3#72005)
8 years, 11 months
[JBoss JIRA] (LOGTOOL-124) Ability to provide exception producer
by James Perkins (JIRA)
[ https://issues.jboss.org/browse/LOGTOOL-124?page=com.atlassian.jira.plugi... ]
James Perkins reassigned LOGTOOL-124:
-------------------------------------
Assignee: James Perkins
> Ability to provide exception producer
> -------------------------------------
>
> Key: LOGTOOL-124
> URL: https://issues.jboss.org/browse/LOGTOOL-124
> Project: Log Tool
> Issue Type: Feature Request
> Reporter: David Lloyd
> Assignee: James Perkins
> Priority: Minor
> Fix For: 2.1.0.Alpha3
>
>
> Sometimes you must use the same exception message for many different types of exception. It would be nice if you could give a parameter which can produce an exception, like this:
> {code}
> public interface MyLogs {
> // ...
> @Message(id = 1234, "The operation failed due to %s")
> <T extends Throwable> T operationFailed(@Producer Function<String, T> fn, String thing);
> }
> {code}
> And later at usage:
> {code}
> // ...
> throw MyLogs.log.operationFailed(IOException::new, "thingy");
> {code}
> A valid function parameter must return a type which is equal or assignable to the return type, and is assignable to Throwable. Other than that, it can be treated the same as as if you were dealing with a constructor class that has exactly one constructor, using the same matching/inference logic, meaning you could also accept BiFunction which accepts two arguments.
--
This message was sent by Atlassian JIRA
(v7.2.3#72005)
8 years, 11 months
[JBoss JIRA] (ELY-1189) Create better way of masking passwords using modern PBE algorithm
by Peter Skopek (JIRA)
[ https://issues.jboss.org/browse/ELY-1189?page=com.atlassian.jira.plugin.s... ]
Peter Skopek commented on ELY-1189:
-----------------------------------
pskopek commented on 12 Jan
I don't think that we should start with simple obfuscation at current stage. We can consider it later.
[1] For now I suggest to implement PB compatible version of MASK-xxx in KeyStoreCredentialStore.
[2] We can also consider to introduce type to credential-reference which can point to credential store with InitialKey and all other parameters (IV, salt, iteration count) will be encoded in alias part of the reference.
We don't have to change Elytron API as we already have PBE utility class in place.
We can also later reimplement it with proper password types.
Part [2] will also be usable in KeyStoreCredentialStore protection parameter, so users can decide which way they want to use it.
> Create better way of masking passwords using modern PBE algorithm
> -----------------------------------------------------------------
>
> Key: ELY-1189
> URL: https://issues.jboss.org/browse/ELY-1189
> Project: WildFly Elytron
> Issue Type: Task
> Components: Credential Store
> Reporter: Peter Skopek
> Assignee: Peter Skopek
>
> Create better way of masking passwords using modern PBE algorithm.
> This bug contains discussion from PR: https://github.com/wildfly-security/wildfly-elytron/pull/619
> To have this documented and PR closed.
--
This message was sent by Atlassian JIRA
(v7.2.3#72005)
8 years, 11 months
[JBoss JIRA] (ELY-1189) Create better way of masking passwords using modern PBE algorithm
by Peter Skopek (JIRA)
[ https://issues.jboss.org/browse/ELY-1189?page=com.atlassian.jira.plugin.s... ]
Peter Skopek commented on ELY-1189:
-----------------------------------
dmlloyd commented on 12 Jan
Peter is right, the priority is to get the compatible implementation to be functional. Since the PB variant doesn't use IV, to me that means fixing MaskedPassword to only support the algorithms that fit its structure, and fixing its specific incompatiblities with PB. Then we can open JIRAs to look at encrypted two-way passwords and/or simple obfuscation algorithms later (rot13 is a simple example however it doesn't really account for the Unicode world we live in today; a JIRA is an OK place to discuss this).
> Create better way of masking passwords using modern PBE algorithm
> -----------------------------------------------------------------
>
> Key: ELY-1189
> URL: https://issues.jboss.org/browse/ELY-1189
> Project: WildFly Elytron
> Issue Type: Task
> Components: Credential Store
> Reporter: Peter Skopek
> Assignee: Peter Skopek
>
> Create better way of masking passwords using modern PBE algorithm.
> This bug contains discussion from PR: https://github.com/wildfly-security/wildfly-elytron/pull/619
> To have this documented and PR closed.
--
This message was sent by Atlassian JIRA
(v7.2.3#72005)
8 years, 11 months
[JBoss JIRA] (ELY-1189) Create better way of masking passwords using modern PBE algorithm
by Peter Skopek (JIRA)
[ https://issues.jboss.org/browse/ELY-1189?page=com.atlassian.jira.plugin.s... ]
Peter Skopek commented on ELY-1189:
-----------------------------------
zregvart commented on 12 Jan
All good points, let me open up another can of worms
Assuming that the goal of MaskedPassword is to prevent someone from glancing over and seeing the password in clear text I would argue that the current MaskedPassword could be split into two implementations PickBoxMaskedPassword and SimpleMaskedPassword (example name).
PickBoxMaskedPassword would remain for compatibility with PicketBox. While SimpleMaskedPassword would use simple algorithm to obfuscate the password (ROT13, XOR).
I think there is really little value from cryptography standpoint, form using an KDF for generating the key to transform (encrypt/decrypt) clear text password and exposing all the parameters for the KDF (in this case the initial secret, hardcoded "somearbitr...") and the transformation (salt, iteration count, IV) also in the clear.
I also think that it could be CredentialStore-s domain to pick if it wants to derive key for its protection from a Password (probably transformed to ClearPasswordSpec) by using a KDF of choice and so there should be no need for using a KDF in MaskedPassword.
Also using the KDF (SecretKeyFactory) in the current implementation with no with 0 iterations and no salt (default for PBEKeySpec if not specified) is not adding any security as the key would be used verbatim (check the getEncoded of the resulting SecretKey).
> Create better way of masking passwords using modern PBE algorithm
> -----------------------------------------------------------------
>
> Key: ELY-1189
> URL: https://issues.jboss.org/browse/ELY-1189
> Project: WildFly Elytron
> Issue Type: Task
> Components: Credential Store
> Reporter: Peter Skopek
> Assignee: Peter Skopek
>
> Create better way of masking passwords using modern PBE algorithm.
> This bug contains discussion from PR: https://github.com/wildfly-security/wildfly-elytron/pull/619
> To have this documented and PR closed.
--
This message was sent by Atlassian JIRA
(v7.2.3#72005)
8 years, 11 months
[JBoss JIRA] (ELY-1189) Create better way of masking passwords using modern PBE algorithm
by Peter Skopek (JIRA)
[ https://issues.jboss.org/browse/ELY-1189?page=com.atlassian.jira.plugin.s... ]
Peter Skopek commented on ELY-1189:
-----------------------------------
dmlloyd commented on 11 Jan
This is a fair point @zregvart. But from an API perspective it can cause a problem since the IV necessarily has to impact the equality of a Password object, being a constituent part of its fields.
Since security is not really an expectation with masked passwords (it's a two-way password type with no ancillary information, meaning that if you have the mask string, you have the original password), it might make sense to have a separate MaskedPassword versus EncryptedPassword, the latter including an IV? Or maybe it's simply not worth worrying about the IV variants (since that's essentially a new feature).
> Create better way of masking passwords using modern PBE algorithm
> -----------------------------------------------------------------
>
> Key: ELY-1189
> URL: https://issues.jboss.org/browse/ELY-1189
> Project: WildFly Elytron
> Issue Type: Task
> Components: Credential Store
> Reporter: Peter Skopek
> Assignee: Peter Skopek
>
> Create better way of masking passwords using modern PBE algorithm.
> This bug contains discussion from PR: https://github.com/wildfly-security/wildfly-elytron/pull/619
> To have this documented and PR closed.
--
This message was sent by Atlassian JIRA
(v7.2.3#72005)
8 years, 11 months