Documentation
¶
Overview ¶
Package crypto provides the low-level primitives authit's service packages build on: password hashing, opaque token generation/hashing, TOTP enrollment/validation, and secret-at-rest encryption. Nothing here touches storage or transport.
Index ¶
- Constants
- Variables
- func CheckPassword(password, hash string) bool
- func DecryptSecret(key []byte, ciphertext []byte) (string, error)
- func EncryptSecret(key []byte, plaintext string) ([]byte, error)
- func GenerateBackupCodes(n int) ([]string, error)
- func GenerateOpaqueToken() (raw string, hash string, err error)
- func GenerateTOTPSecret(issuer, accountName string) (*otp.Key, error)
- func GenerateUserCode() (string, error)
- func HashBackupCode(code string) string
- func HashPassword(password string) (string, error)
- func HashPasswordWithCost(password string, cost int) (string, error)
- func HashToken(raw string) string
- func NewID() (string, error)
- func ValidateTOTPCode(secret, code string) bool
Constants ¶
const DefaultBcryptCost = bcrypt.DefaultCost
DefaultBcryptCost matches bcrypt's own default and is what HashPassword uses unless overridden via HashPasswordWithCost.
Variables ¶
var ErrInvalidKeySize = errors.New("authit/crypto: key must be 32 bytes")
ErrInvalidKeySize is returned by EncryptSecret/DecryptSecret when the key is not 32 bytes (AES-256).
Functions ¶
func CheckPassword ¶
CheckPassword reports whether password matches the given bcrypt hash.
func DecryptSecret ¶
DecryptSecret reverses EncryptSecret.
func EncryptSecret ¶
EncryptSecret encrypts plaintext (e.g. a TOTP secret) with AES-256-GCM under key, so it can be stored at rest without exposing it to anyone with read access to the database alone.
func GenerateBackupCodes ¶
GenerateBackupCodes returns n single-use recovery codes in plaintext. The caller is responsible for showing them to the user exactly once and persisting only their hashes via HashBackupCode.
func GenerateOpaqueToken ¶
GenerateOpaqueToken returns a fresh cryptographically random token (used for refresh tokens, password reset links, email verification links, and pending-2FA sessions) together with its hash. Only the hash should ever be persisted; the raw value is returned to the caller exactly once.
func GenerateTOTPSecret ¶
GenerateTOTPSecret creates a new base32 TOTP secret for the given account (typically the user's email) under issuer (typically the host application's name).
func GenerateUserCode ¶
GenerateUserCode returns an 8-character device-flow user code formatted as "XXXX-XXXX" (RFC 8628 §6.1's recommended shape), e.g. "WDJB-MJHT". At ~34.5 bits of entropy it is deliberately low relative to the device_code — the security property comes from rate-limiting guesses at the verification endpoint, not from the code's entropy alone.
func HashBackupCode ¶
HashBackupCode hashes a backup code for storage/comparison, using the same opaque-token hash as everywhere else in authit.
func HashPassword ¶
HashPassword hashes a plaintext password for storage.
func HashPasswordWithCost ¶
HashPasswordWithCost hashes a plaintext password using an explicit bcrypt cost, e.g. a lower cost in tests to keep them fast.
func NewID ¶
NewID returns a random UUIDv4 string. authit's service packages use this to assign IDs before handing records to a Store, so stores never need to generate identifiers themselves.
func ValidateTOTPCode ¶
ValidateTOTPCode reports whether code is a currently-valid TOTP code for secret.
Types ¶
This section is empty.
Source Files