IsPasswordStrong has weak password complexity (Bugzilla Bug 4650)

[tianocore-issues]

This issue was created automatically with bugzilla2github

Bugzilla Bug 4650

Date: 2024-01-17T02:02:19+00:00
From: tabassum.yasmin
To: tabassum.yasmin
CC: @lgao4

Last updated: 2024-01-30T21:45:20+00:00

[tianocore-issues]

Comment 22379

Date: 2024-01-17 02:02:19 +0000
From: tabassum.yasmin

• Industry Specification: ---
• Release Observed: edk2-stable202305
• Releases to Fix: edk2-stable202305
• Target OS: ---
• Bugzilla Assignee(s): tabassum.yasmin

sPasswordStrong checks for password complexity requirements. As shown below, it does bare minimal
checking for existence of uppercase, lowercase, numeral, and symbol. A password with repeating characters
would be an acceptable password, such as 1!Aaaaaa.IsPasswordInHistory checks if the password hash of the password being entered matches the hash of the
previous 5 passwords.
Code snippet below

BOOLEAN
IsPasswordStrong (
IN CHAR8 *Password,
IN UINTN PasswordSize
)
{
UINTN Index;
BOOLEAN HasLowerCase;
BOOLEAN HasUpperCase;
BOOLEAN HasNumber;
BOOLEAN HasSymbol;
if (PasswordSize < PASSWORD_MIN_SIZE) {
return FALSE;
}
HasLowerCase = FALSE;
HasUpperCase = FALSE;
HasNumber = FALSE;
HasSymbol = FALSE;
for (Index = 0; Index < PasswordSize - 1; Index++) {
if (Password[Index] >= 'a' && Password[Index] <= 'z') {
HasLowerCase = TRUE;
} else if (Password[Index] >= 'A' && Password[Index] <= 'Z') {
HasUpperCase = TRUE;
} else if (Password[Index] >= '0' && Password[Index] <= '9') {
HasNumber = TRUE;
} else {
HasSymbol = TRUE;
}
}
if ((!HasLowerCase) || (!HasUpperCase) || (!HasNumber) || (!HasSymbol)) {
return FALSE;
}
return TRUE;

#define PASSWORD_HISTORY_CHECK_COUNT 5
…
BOOLEAN
IsPasswordInHistory (
IN EFI_GUID *UserGuid,
IN CHAR8 *Password,
IN UINTN PasswordSize
)
{
EFI_STATUS Status;
USER_PASSWORD_VAR_STRUCT UserPasswordVarStruct;
UINTN Index;
for (Index = 1; Index <= PASSWORD_HISTORY_CHECK_COUNT; Index++) {
Status = GetPasswordHashFromVariable (UserGuid, Index, &UserPasswordVarStruct);
if (!EFI_ERROR(Status)) {
Status = VerifyPassword (Password, PasswordSize, &UserPasswordVarStruct);
if (!EFI_ERROR(Status)) {

[tianocore-issues]

Comment 22458

Date: 2024-01-30 21:45:20 +0000
From: @lgao4

[email protected]: will you provide the patch to fix it?