Documentation
¶
Overview ¶
Package hash hashes and verifies passwords: argon2id by default (PHC string format), bcrypt for compatibility. Verify recognises both, so a database can move from bcrypt to argon2id through NeedsRehash on login.
Index ¶
Constants ¶
This section is empty.
Variables ¶
View Source
var DefaultArgon2 = Argon2Params{ Memory: 64 * 1024, Time: 1, Threads: 4, SaltLen: 16, KeyLen: 32, } //nolint:gochecknoglobals // read-only defaults
DefaultArgon2 follows the OWASP password storage recommendation (m=64 MiB, t=1, p=4) with 16-byte salts and 32-byte keys.
View Source
var ErrPasswordTooLong = errors.New("hash: password longer than 72 bytes (bcrypt limit)")
ErrPasswordTooLong is returned by bcrypt for inputs over 72 bytes, which bcrypt would otherwise silently truncate.
View Source
var ErrUnknownFormat = errors.New("hash: unknown hash format")
ErrUnknownFormat is returned for hashes neither argon2id nor bcrypt.
Functions ¶
Types ¶
type Argon2Params ¶
type Argon2Params struct {
Memory uint32 // KiB
Time uint32
Threads uint8
SaltLen uint32
KeyLen uint32
}
Argon2Params configures argon2id (RFC 9106).
type Hasher ¶
type Hasher interface {
// Make hashes password with a fresh random salt.
Make(password string) (string, error)
// Verify reports whether password matches hash (argon2id or bcrypt).
Verify(hash, password string) (bool, error)
// NeedsRehash reports whether hash was made with other parameters or
// algorithm than this hasher's, so it should be replaced after login.
NeedsRehash(hash string) bool
}
Hasher creates password hashes and verifies them in constant time.
Source Files
Click to show internal directories.
Click to hide internal directories.