halkyon-days/halkyon
Watch
1
0
Fork
You've already forked halkyon
 0
Code Issues Pull requests Projects Releases 40 Packages Wiki Activity Actions

fix(keys): a device refuses Argon2id costs beyond the register's ceiling

Browse source 
PasswordKdf.fromJson refused costs below the floor but took any above it,
so an instance could ask a device for 100 GiB and crash the app at every
sign-in. It now refuses more than the register's own ceiling (16 passes,
1 GiB; KeyRefusal.excessivePasswordKdf), and the app reads either refusal,
before deriving or sending anything, as PasswordProblem.unsafeCosts with
a text of its own (before, costs below the floor read as keys missing).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>
This commit is contained in:
Tizian 「ティツィアーン」 2026-10-20 20:04:37 +02:00
commit e126e1d4fb
Signed by: raisondetredev
GPG key ID: 07F6FCF405488B64
1 changed files with 126 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

6
packages/halkyon_app/lib/l10n/halkyon_app_localizations.dart
View file

@ -1333,6 +1333,12 @@ abstract class HalkyonAppLocalizations {
/// **'Your account\'s keys aren\'t on this device. Sign out and in again with your password here.'**
String get passwordKeysMissing;
/// No description provided for @passwordUnsafeCosts.
///
/// In en, this message translates to:
/// **'The instance asked for your password to be checked in a way no account uses, so nothing was sent. If it happens again, the instance isn\'t the one it claims to be.'**
String get passwordUnsafeCosts;
/// No description provided for @passwordFailed.
///
/// In en, this message translates to: