Documentation
¶
Overview ¶
Package password hashes and verifies passwords with argon2id, and checks new passwords against the length policy in the auth standard.
Hashes are stored in the standard PHC string format, which keeps the algorithm, parameters, salt, and hash together:
$argon2id$v=19$m=19456,t=2,p=1$<salt>$<hash>
Storing the parameters with each hash lets them be raised later: after a successful login, NeedsRehash reports whether the hash should be replaced.
Index ¶
Constants ¶
const ( MinLength = 12 MaxLength = 256 )
Length limits for new passwords, counted in characters (runes), not bytes.
Variables ¶
var ( // ErrTooShort means a new password has fewer than MinLength characters. ErrTooShort = errors.New("password is too short") // ErrTooLong means a new password has more than MaxLength characters. ErrTooLong = errors.New("password is too long") // ErrInvalidUTF8 means a new password isn't valid UTF-8 text. ErrInvalidUTF8 = errors.New("password is not valid UTF-8") // ErrInvalidHash means a stored hash couldn't be parsed. ErrInvalidHash = errors.New("invalid password hash") // ErrIncompatibleVersion means a stored hash uses an argon2 version this // package doesn't support. ErrIncompatibleVersion = errors.New("incompatible argon2 version") )
var DefaultParams = Params{
Memory: 19 * 1024,
Iterations: 2,
Parallelism: 1,
SaltLength: 16,
KeyLength: 32,
}
DefaultParams are OWASP's minimum recommended settings for argon2id: 19 MiB of memory, 2 iterations, parallelism 1.
Functions ¶
func NeedsRehash ¶
NeedsRehash reports whether an encoded hash was made with different parameters than p, so it should be replaced after the next successful login.
func SimulateVerify ¶
func SimulateVerify(password string)
SimulateVerify does the same amount of work as Verify with DefaultParams, for logins with an email that has no account. Without it, a login for a nonexistent account would return noticeably faster, revealing which emails are registered.
Source Files