halkyon-days/halkyon
Watch
1
0
Fork
You've already forked halkyon
 0
Code Issues Pull requests Projects Releases 37 Packages Wiki Activity Actions

fix(keys): a device refuses Argon2id costs beyond the register's ceiling

Browse source 
PasswordKdf.fromJson refused costs below the floor but took any above it,
so an instance could ask a device for 100 GiB and crash the app at every
sign-in. It now refuses more than the register's own ceiling (16 passes,
1 GiB; KeyRefusal.excessivePasswordKdf), and the app reads either refusal,
before deriving or sending anything, as PasswordProblem.unsafeCosts with
a text of its own (before, costs below the floor read as keys missing).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>
This commit is contained in:
Tizian 「ティツィアーン」 2026-10-20 20:04:37 +02:00
commit e126e1d4fb
Signed by: raisondetredev
GPG key ID: 07F6FCF405488B64
5 changed files with 126 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

1
packages/halkyon_app/lib/l10n/halkyon_app_de.arb
View file

@ -205,5 +205,6 @@
"passwordUnusable": "Dieses Passwort geht nicht: Es ist leer oder enthält Zeichen, die kein Text sind.",
"passwordInstanceUnproven": "Die Instanz konnte nicht beweisen, dass sie dein Passwort kennt, daher vertraut dieses Gerät ihr nicht. Versuch es noch einmal; passiert es wieder, ist die Instanz nicht die, die sie zu sein behauptet.",
"passwordKeysMissing": "Die Schlüssel deines Kontos sind nicht auf diesem Gerät. Melde dich hier ab und mit deinem Passwort wieder an.",
"passwordUnsafeCosts": "Die Instanz wollte dein Passwort auf eine Weise prüfen lassen, die kein Konto nutzt, daher wurde nichts gesendet. Passiert es wieder, ist die Instanz nicht die, die sie zu sein behauptet.",
"passwordFailed": "Die Instanz war nicht erreichbar. Prüf die Verbindung und versuch es noch einmal."
}

1
packages/halkyon_app/lib/l10n/halkyon_app_en.arb
View file

@ -431,5 +431,6 @@
"passwordUnusable": "This password can't be used: it's empty, or holds characters that aren't text.",
"passwordInstanceUnproven": "The instance couldn't prove it knows your password, so this device trusts nothing it says. Try again; if it happens again, the instance isn't the one it claims to be.",
"passwordKeysMissing": "Your account's keys aren't on this device. Sign out and in again with your password here.",
"passwordUnsafeCosts": "The instance asked for your password to be checked in a way no account uses, so nothing was sent. If it happens again, the instance isn't the one it claims to be.",
"passwordFailed": "Couldn't reach the instance. Check the connection and try again."
}

6
packages/halkyon_app/lib/l10n/halkyon_app_localizations.dart
View file

@ -1333,6 +1333,12 @@ abstract class HalkyonAppLocalizations {
/// **'Your account\'s keys aren\'t on this device. Sign out and in again with your password here.'**
String get passwordKeysMissing;
/// No description provided for @passwordUnsafeCosts.
///
/// In en, this message translates to:
/// **'The instance asked for your password to be checked in a way no account uses, so nothing was sent. If it happens again, the instance isn\'t the one it claims to be.'**
String get passwordUnsafeCosts;
/// No description provided for @passwordFailed.
///
/// In en, this message translates to:

4
packages/halkyon_app/lib/l10n/halkyon_app_localizations_de.dart
View file

@ -766,6 +766,10 @@ class HalkyonAppLocalizationsDe extends HalkyonAppLocalizations {
String get passwordKeysMissing =>
'Die Schlüssel deines Kontos sind nicht auf diesem Gerät. Melde dich hier ab und mit deinem Passwort wieder an.';
@override
String get passwordUnsafeCosts =>
'Die Instanz wollte dein Passwort auf eine Weise prüfen lassen, die kein Konto nutzt, daher wurde nichts gesendet. Passiert es wieder, ist die Instanz nicht die, die sie zu sein behauptet.';
@override
String get passwordFailed =>
'Die Instanz war nicht erreichbar. Prüf die Verbindung und versuch es noch einmal.';

4
packages/halkyon_app/lib/l10n/halkyon_app_localizations_en.dart
View file

@ -749,6 +749,10 @@ class HalkyonAppLocalizationsEn extends HalkyonAppLocalizations {
String get passwordKeysMissing =>
'Your account\'s keys aren\'t on this device. Sign out and in again with your password here.';
@override
String get passwordUnsafeCosts =>
'The instance asked for your password to be checked in a way no account uses, so nothing was sent. If it happens again, the instance isn\'t the one it claims to be.';
@override
String get passwordFailed =>
'Couldn\'t reach the instance. Check the connection and try again.';