Documentation
¶
Overview ¶
Package crypto holds the password hashing and token primitives of Auth-All.
Index ¶
- Constants
- Variables
- func HashPassword(password string, p Argon2Params) (string, error)
- func HashToken(token string) string
- func NeedsRehash(stored Argon2Params, want Argon2Params) bool
- func NewPKCEVerifier() (string, error)
- func NewRecoveryCodes(n int) ([]string, error)
- func NewToken() (string, error)
- func NormalizeRecoveryCode(code string) string
- func PKCEChallenge(verifier string) string
- type Argon2Params
Constants ¶
const ( RecoveryCodeGroups = 2 RecoveryCodeGroupSize = 5 )
RecoveryCodeGroups and RecoveryCodeGroupSize describe the shape of one code. Two groups of five characters read well from paper.
const TokenBytes = 32
TokenBytes is the entropy of every generated token. 32 bytes is 256 bits.
Variables ¶
var ErrInvalidHash = errors.New("authall: the stored password hash is invalid")
ErrInvalidHash reports a stored hash that cannot be decoded.
Functions ¶
func HashPassword ¶
func HashPassword(password string, p Argon2Params) (string, error)
HashPassword returns a PHC encoded Argon2id hash.
func HashToken ¶
HashToken returns the hex encoded SHA-256 hash of a token. Auth-All stores only this value.
func NeedsRehash ¶
func NeedsRehash(stored Argon2Params, want Argon2Params) bool
NeedsRehash reports whether a stored hash uses different parameters than the configured ones. A successful sign-in then rehashes the password.
func NewPKCEVerifier ¶
NewPKCEVerifier returns a PKCE code verifier.
func NewRecoveryCodes ¶ added in v0.2.0
NewRecoveryCodes returns n random recovery codes in the form abcde-fghij.
A code is a second factor and a first factor at the same time, so treat the returned values like a password reset token. Show them one time and store only the hash.
func NormalizeRecoveryCode ¶ added in v0.2.0
NormalizeRecoveryCode returns the comparable form of a recovery code.
A person retypes a code from paper, so the case, the separator, and the spaces vary. The stored hash covers this form, so every variant of one code matches.
func PKCEChallenge ¶
PKCEChallenge returns the S256 challenge for a verifier.
Types ¶
type Argon2Params ¶
type Argon2Params struct {
Memory uint32
Iterations uint32
Parallelism uint8
SaltLength uint32
KeyLength uint32
}
Argon2Params holds the Argon2id cost parameters. Every stored hash encodes the parameters that produced it.
func DefaultArgon2Params ¶
func DefaultArgon2Params() Argon2Params
DefaultArgon2Params returns the secure default cost parameters.
func VerifyPassword ¶
func VerifyPassword(password, encoded string) (bool, Argon2Params, error)
VerifyPassword reports whether the password matches the encoded hash. It also returns the parameters that produced the stored hash.
Source Files