Documentation
¶
Overview ¶
Package auth holds the pieces of logging in that do not depend on the web: password hashing, one-time codes and recovery codes.
Index ¶
- Constants
- func CheckPassword(hash, pw string) bool
- func CheckPasswordRules(pw string) *msg.Error
- func CheckSFTPPassword(hash, pw string) bool
- func CheckTOTP(secret []byte, code string, now time.Time) (step int64, ok bool)
- func DummyCheck(pw string)
- func DummySFTPCheck(pw string)
- func HashPassword(pw string) string
- func HashRecoveryCode(code string) []byte
- func NewRecoveryCodes() (codes []string, hashes [][]byte)
- func NewTOTPSecret() []byte
- func TOTPCode(secret []byte, step int64) string
- func TOTPSecretText(secret []byte) string
- func TOTPURI(secret []byte, issuer, account string) string
- type Pool
Constants ¶
const MinPasswordLength = 10
MinPasswordLength follows NIST SP 800-63B for passwords used together with a second factor.
Variables ¶
This section is empty.
Functions ¶
func CheckPassword ¶
CheckPassword reports whether pw matches the hash. It reads the parameters from the hash, so older hashes keep working if the defaults change.
func CheckPasswordRules ¶
func CheckSFTPPassword ¶ added in v0.7.4
CheckSFTPPassword is CheckPassword on the pool kept for SFTP.
func CheckTOTP ¶
CheckTOTP looks for code in the current time step and one step either side, to allow for clocks that are slightly off. It returns the step that matched, which the caller stores so the same code cannot be used twice.
func DummyCheck ¶
func DummyCheck(pw string)
DummyCheck costs as much as CheckPassword. It is used when an account does not exist, so response times do not tell who has one.
func DummySFTPCheck ¶ added in v0.7.4
func DummySFTPCheck(pw string)
DummySFTPCheck is DummyCheck on the pool kept for SFTP.
func HashPassword ¶
HashPassword returns an argon2id hash in the PHC string format.
func HashRecoveryCode ¶
HashRecoveryCode ignores case, spaces and dashes, since people type these by hand.
func NewRecoveryCodes ¶
NewRecoveryCodes returns codes such as "k7m2p-x9qfa" and the hashes to store.
func NewTOTPSecret ¶
func NewTOTPSecret() []byte
NewTOTPSecret returns a random 160-bit secret, as RFC 4226 recommends.
func TOTPCode ¶ added in v0.2.6
TOTPCode is the code an authenticator app shows in a time step, for tools that log in the way a person would.
func TOTPSecretText ¶
TOTPSecretText is the secret for typing into an app by hand.
Source Files