3.2.5.1.6 Manual Password Reset

  • Article

On change of password reset status from pending to approved, the management server MUST implement the following rules to decrypt and re-encrypt master keys:

  1. MUST use the management domain's data encryption private key to decrypt encrypted storage master keys information using the RSA algorithm as defined in [PKCS1].

  2. MUST take the first 20 bytes of the result, and save it as a verifier for the following comparison.

  3. MUST take the remaining bytes of the result, and save it as a master key itself for following processing.

  4. MUST compute the SHA1 hash of the account GUID and the master key, in this order.

    1. AccountGUID is a Unicode string, which, for the purposes of the SHA1 hash, MUST be interpreted as a byte array, not including the NULL-terminator (two bytes).

  5. MUST compare the verifier saved in rule 2 with the result of the hash.

  6. If not equal, the management server MUST send a Fault message with a 218 fault code to the client when the client asks for the status of reset.

  7. Otherwise, the management server MUST encrypt the master key using the encryption public key from the temporary contact sent by the client.

  8. The encryption public key MUST be parsed as defined in section 3.1.2.

  9. Encryption MUST be done using RSA or ElGamal encryption.

  10. Both newly encrypted master keys MUST be persisted until it is sent to the client.

The master key is used for encrypting the account keys and the secret master key is used to establish the handshake communication. See section 5 for a description of the master key and secret master key.