fix: update shared constants to reflect new NIST sizes

Author: chadsec1

core/constants.py

@@ -10,6 +10,8 @@
 LONGPOLL_MAX  = 30  
 
 # crypto parameters (bytes)
+CHALLENGE_LEN     = 11264
+
 AES_GCM_NONCE_LEN = 12
 
 OTP_PAD_SIZE       = 11264

logic/authentication.py

@@ -2,7 +2,8 @@
 from core.requests import http_request
 from core.crypto import create_signature 
 from core.constants import (
-        ML_DSA_87_NAME
+        ML_DSA_87_NAME,
+        CHALLENGE_LEN
 )
 
 def authenticate_account(user_data: dict) -> dict:
@@ -11,26 +12,26 @@ def authenticate_account(user_data: dict) -> dict:
     private_key = user_data["lt_auth_sign_keys"]["private_key"]
     public_key_encoded = user_data["lt_auth_sign_keys"]["public_key"]
     public_key_encoded = b64encode(public_key_encoded).decode()
+    user_id = user_data.get("user_id") or ""
 
     try:
-        user_id = user_data.get("user_id") or ""
-
         response = http_request(url + "/authenticate/init", "POST", payload = {"public_key": public_key_encoded, "user_id": user_id })
-        if not 'challenge' in response:
-            raise ValueError("Server did not give authenticatation challenge! Are you sure this is a Coldwire server ?")
     except Exception:
         if user_data["settings"]["proxy_info"] is not None:
             raise ValueError("Could not connect to server! Are you sure your proxy settings are valid ?")
         else:
             raise ValueError("Could not connect to server! Are you sure the URL is valid ?")
 
+    if not 'challenge' in response:
+        raise ValueError("Server did not give authenticatation challenge! Are you sure this is a Coldwire server ?")
+
     try:
         challenge = b64decode(response["challenge"], validate=True)
     except Exception:
         raise ValueError("Server gave a malformed challenge! Are you sure this is Coldwire server ?")
 
 
-    signature = create_signature(ML_DSA_87_NAME, challenge, private_key)
+    signature = create_signature(ML_DSA_87_NAME, challenge[:CHALLENGE_LEN], private_key)
 
     try:
         response = http_request(url + "/authenticate/verify", "POST", payload = {"signature": b64encode(signature).decode(), "challenge": response["challenge"]})