|
Hello everyone! I have written a very simple tool called torhash to generate hashed passwords/strings according to the instructions in control spec to authenticate with the controller interface (TC?). I did not actually study the S2K algorithm since I found it hard to understand RFC 2440, I studied source code and bit by bit I figured out what was happening behind the scenes! The reason I did this is that I am working on another program called ProxAllium which acts as a graphical user interface for Tor, I am currently in the process of rewriting it in C to make it cross-platform (along with a few other reasons...). I hit a roadblock while I was implementing support for interacting with the controller interface, I had to make a choice between calling Tor to generate the hashed password or to hash the password in the program itself. I felt like hashing the password in the program itself was the right choice, I had a few other weak reasons to not call Tor for hashing the password but my gut was the main motivator behind this choice. I created torhash (apologies about the bad name choice) as a proof-of-concept and to improve my general programming skills, I had no prior experience working with cryptography or hash functions on this level, so I went with the simplest library I could find for hashing the data. I could have gone with OpenSSL, as I believe that it is the de-facto cross-platform standard for cryptography and cryptographic hashing, I am currently looking into using it, but I am not yet sure if this is a good idea. I would be grateful if some of you can take out some time to have a look, I am very excited to hear your opinions and any advice that you may have to help me improve, the code itself is very simple and short (114 lines of code). Pardon any mistakes or bad code that I may have written, I have only begun programming relatively recently and my experience with low-level development (with C) is very recent. Thank you for reading and for the input in advance!
Best Regards, Damon H. (TheDcoder) |
_______________________________________________ tor-dev mailing list tor-dev@xxxxxxxxxxxxxxxxxxxx https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-dev