1560806 - Increase softoken password max size to 500 characters

Status: RESOLVED FIXED

(NSS :: Libraries, enhancement, P1)

Description

[Thomas James "Tom" Seymour]

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:67.0) Gecko/20100101 Firefox/67.0

Steps to reproduce:

I want a master password of 341 characters (with spaces) on my Windows 10 and iMac installation of Firefox Stable.

Actual results:

I get an error message that says "Unable to change master password" when I either try to set the 341-character master password or replace a shorter password with it.

Expected results:

I think 400 characters is a good limit for master passwords with Firefox. I sure can remember all that.

Comment 1

[Thomas James "Tom" Seymour]

I just wrote on the official Firefox Twitter page asking the limit for master passwords be upped to 400 characters.

Comment 2

[Hani Yacoub, Desktop QA]

Assigning "Toolkit: Password Manager" component for this one.

Comment 3

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

Softoken seems to limit passwords to 255 bytes: https://searchfox.org/mozilla-central/rev/0671407b7b9e3ec1ba96676758b33316f26887a4/security/nss/lib/softoken/pkcs11i.h#462

Comment 4

[Marcus Burghardt]

Hi,

I did some researches about some possible impacts, limitation or recommendations about this password size limit in general.
Looks that currently, all platforms and functions should be fine with this change until something even bigger than 1000, for instance.

So, changing this limit should not be a problem for NSS itself.
However, I prefer to be more conservative for now and set this limit to something about 400 or 500, as suggested by Thomas.
I am already testing a patch.

P.S.: Thomas, just by curiosity, did you reached this suggested number (400) based in some specific document? If yes, could you inform here, please?

Thanks,

Comment 5

[Marcus Burghardt]

Hum, looks that is not only change some sizes.
PK11_InitPin() is failing when a password greater than 255 is sent.

I need more time to investigate other parts of the code and the impact of changing them.

Actually was only a tricky from my local libs. : )

Comment 6

[Marcus Burghardt]

Attachment: Bug 1560806 - Increased the max size supported for softoken passwords. r=jcj

Comment 7

[J.C. Jones [:jcj] (he/him)]

https://hg.mozilla.org/projects/nss/rev/d57bae1204fa4643d75ca20e3a5b518a4e21c6df