Documentation
¶
Overview ¶
Package crypto holds the password hashing and token primitives of Auth-All.
Index ¶
- Constants
- Variables
- func HashPassword(password string, p Argon2Params) (string, error)
- func HashToken(token string) string
- func NeedsRehash(stored Argon2Params, want Argon2Params) bool
- func NewPKCEVerifier() (string, error)
- func NewToken() (string, error)
- func PKCEChallenge(verifier string) string
- type Argon2Params
Constants ¶
const TokenBytes = 32
TokenBytes is the entropy of every generated token. 32 bytes is 256 bits.
Variables ¶
var ErrInvalidHash = errors.New("authall: the stored password hash is invalid")
ErrInvalidHash reports a stored hash that cannot be decoded.
Functions ¶
func HashPassword ¶
func HashPassword(password string, p Argon2Params) (string, error)
HashPassword returns a PHC encoded Argon2id hash.
func HashToken ¶
HashToken returns the hex encoded SHA-256 hash of a token. Auth-All stores only this value.
func NeedsRehash ¶
func NeedsRehash(stored Argon2Params, want Argon2Params) bool
NeedsRehash reports whether a stored hash uses different parameters than the configured ones. A successful sign-in then rehashes the password.
func NewPKCEVerifier ¶
NewPKCEVerifier returns a PKCE code verifier.
func PKCEChallenge ¶
PKCEChallenge returns the S256 challenge for a verifier.
Types ¶
type Argon2Params ¶
type Argon2Params struct {
Memory uint32
Iterations uint32
Parallelism uint8
SaltLength uint32
KeyLength uint32
}
Argon2Params holds the Argon2id cost parameters. Every stored hash encodes the parameters that produced it.
func DefaultArgon2Params ¶
func DefaultArgon2Params() Argon2Params
DefaultArgon2Params returns the secure default cost parameters.
func VerifyPassword ¶
func VerifyPassword(password, encoded string) (bool, Argon2Params, error)
VerifyPassword reports whether the password matches the encoded hash. It also returns the parameters that produced the stored hash.
Source Files