Documentation
¶
Overview ¶
Package hash hashes and verifies passwords: argon2id by default (PHC string format), bcrypt for compatibility. Verify recognises both, so a database can move from bcrypt to argon2id through NeedsRehash on login.
Every Hasher (Default, Argon2id, Bcrypt, Fake for tests) makes and verifies hashes in constant time; the auth guards take one to check passwords on login.
See https://github.com/AlexGalhardo/vukem/blob/main/docs/authentication.md.
Example ¶
package main
import (
"fmt"
"strings"
"github.com/AlexGalhardo/vukem/auth/hash"
)
func main() {
// Apps use hash.Default(); Fake keeps the example fast.
h := hash.Fake()
stored, _ := h.Make("correct horse battery staple")
ok, _ := h.Verify(stored, "correct horse battery staple")
bad, _ := h.Verify(stored, "wrong")
fmt.Println(strings.HasPrefix(stored, "$argon2id$"), ok, bad)
}
Output: true true false
Index ¶
Examples ¶
Constants ¶
This section is empty.
Variables ¶
var ErrPasswordTooLong = errors.New("hash: password longer than 72 bytes (bcrypt limit)")
ErrPasswordTooLong is returned by bcrypt for inputs over 72 bytes, which bcrypt would otherwise silently truncate.
var ErrUnknownFormat = errors.New("hash: unknown hash format")
ErrUnknownFormat is returned for hashes neither argon2id nor bcrypt.
Functions ¶
Types ¶
type Argon2Params ¶
type Argon2Params struct {
Memory uint32 // KiB
Time uint32
Threads uint8
SaltLen uint32
KeyLen uint32
}
Argon2Params configures argon2id (RFC 9106).
func DefaultArgon2Params ¶ added in v0.21.0
func DefaultArgon2Params() Argon2Params
DefaultArgon2Params returns the OWASP password storage recommendation (m=64 MiB, t=1, p=4) with 16-byte salts and 32-byte keys. It returns a copy, so tuning one field never weakens Default for the whole process.
type Hasher ¶
type Hasher interface {
// Make hashes password with a fresh random salt.
Make(password string) (string, error)
// Verify reports whether password matches hash (argon2id or bcrypt).
Verify(hash, password string) (bool, error)
// NeedsRehash reports whether hash was made with other parameters or
// algorithm than this hasher's, so it should be replaced after login.
NeedsRehash(hash string) bool
}
Hasher creates password hashes and verifies them in constant time.
Source Files