hashx

package

v0.17.3 Latest Latest Go to latest Published: Jul 31, 2026 License: Apache-2.0 Imports: 17 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

gitlab.com/devnw/codepros/oss/apic

Links

Open Source Insights

Documentation ¶

Overview ¶

pkg/securex/hashx/algorithm.go Package hashx implements salted, self-describing, FIPS-140-3-aware one-way hashing and constant-time verification for passwords and other authentication material. PBKDF2-HMAC-SHA-256/512 are the only FIPS-approved algorithms; when FIPS 140-3 mode is active (pkg/securex/fipsx.IsFIPS) every other algorithm is refused fail-closed. Encoded outputs are PHC strings (argon2id/scrypt/pbkdf2) or native bcrypt modular-crypt; the leading "$id$" selects the verifier. Code generated by apic; DO NOT EDIT.

pkg/securex/hashx/argon2.go Code generated by apic; DO NOT EDIT.

pkg/securex/hashx/bcrypt.go Code generated by apic; DO NOT EDIT.

pkg/securex/hashx/hashx.go Code generated by apic; DO NOT EDIT.

pkg/securex/hashx/pbkdf2.go Code generated by apic; DO NOT EDIT.

pkg/securex/hashx/pepper.go Code generated by apic; DO NOT EDIT.

pkg/securex/hashx/phc.go Code generated by apic; DO NOT EDIT.

pkg/securex/hashx/policy.go Code generated by apic; DO NOT EDIT.

pkg/securex/hashx/scrypt.go Code generated by apic; DO NOT EDIT.

Index ¶

Variables
func Hash(ctx context.Context, algo Algorithm, plaintext []byte, opts ...Option) (string, error)
func IsFIPSApproved(a Algorithm) bool
func Verify(ctx context.Context, encoded string, plaintext []byte, opts ...Option) (ok bool, needsRehash bool, err error)
type Algorithm
- func DefaultAlgorithm() Algorithm
- func ParseAlgorithm(s string) (Algorithm, error)
type Option
- func WithPepper(p []byte) Option

Constants ¶

This section is empty.

Variables ¶

View Source

var ErrAlgorithmNotFIPSApproved = errors.New("hashx: algorithm not FIPS 140-3 approved")

ErrAlgorithmNotFIPSApproved is returned (fail-closed) when FIPS 140-3 mode is active but a non-approved algorithm is requested.

View Source

var ErrInvalidEncoding = errors.New("hashx: invalid encoded hash")

ErrInvalidEncoding is returned when a stored hash string cannot be parsed.

View Source

var ErrUnknownAlgorithm = errors.New("hashx: unknown algorithm")

ErrUnknownAlgorithm is returned for unrecognized algorithm names.

Functions ¶

func Hash ¶

func Hash(ctx context.Context, algo Algorithm, plaintext []byte, opts ...Option) (string, error)

Hash one-way hashes plaintext with algo and returns a self-describing encoded string (PHC or bcrypt crypt). It is fail-closed under FIPS: a non-approved algorithm yields ErrAlgorithmNotFIPSApproved and no hashing is performed.

func IsFIPSApproved ¶

func IsFIPSApproved(a Algorithm) bool

IsFIPSApproved reports whether a is a FIPS-140-3-approved password KDF. Only PBKDF2 (NIST SP 800-132) qualifies.

func Verify ¶

func Verify(ctx context.Context, encoded string, plaintext []byte, opts ...Option) (ok bool, needsRehash bool, err error)

Verify reports whether plaintext matches encoded. needsRehash is true when the stored algorithm/params are weaker than current policy (upgrade-on-login). An unrecognized or malformed encoding is always a non-match error — never a match.

Types ¶

type Algorithm ¶

type Algorithm string

Algorithm names a password-hashing scheme.

const (
	Argon2id     Algorithm = "argon2id"
	Bcrypt       Algorithm = "bcrypt"
	Scrypt       Algorithm = "scrypt"
	PBKDF2SHA256 Algorithm = "pbkdf2-sha256"
	PBKDF2SHA512 Algorithm = "pbkdf2-sha512"
)

func DefaultAlgorithm ¶

func DefaultAlgorithm() Algorithm

DefaultAlgorithm returns the policy default: a FIPS-approved KDF when FIPS mode is active, else Argon2id (OWASP's first choice).

func ParseAlgorithm ¶

func ParseAlgorithm(s string) (Algorithm, error)

ParseAlgorithm maps a config string to an Algorithm. "pbkdf2" is shorthand for PBKDF2SHA256 (OWASP's FIPS recommendation: HMAC-SHA-256 @ >=600k iterations).

type Option ¶

type Option func(*options)

Option configures a Hash/Verify call.

func WithPepper ¶

func WithPepper(p []byte) Option

WithPepper applies a server-side secret (HMAC-SHA-256) before hashing. The pepper is NOT stored in the encoded hash; rotating it invalidates old hashes.

Source Files ¶

View all Source files

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL