Security improvement

After fixing the most urgent vulnerability in the previous release, here is another one

Small breaking change on the change password

This route now request to have the hash of the old password to be allowed to change it.

Server now support a different key for the signing validation.

Indeed using the same key for both signing and encryption is not a best practice, it has been fixed in the lib and is supported by the server secretin/secretin-lib#58

Rescue code is now protected from the server

The rescue codes you could use if you forgot/lost your TOTP device was generated on the server and stored in clear text.

They are now generated by the client and xored with the hash of the password so the server can't retrieve them.

They are also bigger so less easier to bruteforce.

Fix keys assignment vulnerability

Following Lexfo audit for CSPN

A vulnerability has been identified allowing a malicious user knowing a secret id to create a new user with keys attributes already filled with write permission on the secret.

It doesn't allow to compromise the confidentiality but the server will then let the malicious user do write operation leading to the loose of the secret.

node-forge bumped to the latest version 1.3.1

Cached metadata

Merge pull request #11 from secretin/metadata_cache

Accept big payload for metadata_cache

No more signature replay

To follow changes in secretin-lib, server no longer accepts 2 identical signatures during 30 seconds by default.

Signature embed time and are cached in redis during SIGNATURE_DELAY so if time is too old or exists in redis, signature is rejected.

Change rescue code process for 2FA

Merge pull request #7 from secretin/support_history

Prepare server to support getHistory

Improve view and support getDatabase diff

1.3.1

Prevent server crash when protect key expire

Add rescue codes route

If you lost your phone after TOTP activation, you were screwed. Not anymore. (Linked to update in secretin-lib and secretin-app)

Rewritten server

Merge pull request #1 from secretin/new_server

New server