Documentation
¶
Index ¶
- Constants
- Variables
- func DummyHash() string
- func GeneratePassword() (string, error)
- func GenerateRandString(length int, charsAllowed string) (string, error)
- func GenerateRandomKey(length int) ([]byte, error)
- func GenerateSessionNonce() (string, string, error)
- func HashPassword(password string) (string, error)
- func IsBcryptHash(hash string) bool
- func IsPasswordHash(hash string) bool
- func NeedsRehash(hash string) bool
- func ValidatePassword(password, username string) error
- func VerifyPassword(hash, password string) (bool, error)
Constants ¶
const ( // Password policy (NIST SP 800-63B shape: a length floor, a generous // ceiling, no composition rules) MinPasswordLength = 8 MaxPasswordLength = 128 )
Password hashing for builtin user accounts. Hashes are stored as PHC strings so the algorithm and its parameters are self-describing: new hashes are argon2id with the OWASP recommended minimum parameters, bcrypt hashes ($2a$/$2b$/$2y$, produced by older versions and by `openrun password`) are still verified. A caller which verified a password against a hash NeedsRehash reports as outdated can store HashPassword of the same password to upgrade it in place.
const ( PASSWORD_CHARS = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789@#%^&*()_-+=<>?/|" BCRYPT_COST = 10 )
Variables ¶
var ErrPasswordHashFormat = errors.New("unsupported password hash format")
Functions ¶
func DummyHash ¶ added in v0.20.6
func DummyHash() string
DummyHash returns a fixed argon2id hash of a random secret, used to run a verification of the same cost for an unknown username so response timing does not reveal whether an account exists
func GeneratePassword ¶
GeneratePassword generates a random password
func GenerateRandString ¶ added in v0.18.6
GenerateRandString generates a random string of the given length using crypto/rand, with each character drawn from charsAllowed
func GenerateRandomKey ¶ added in v0.15.3
func GenerateSessionNonce ¶ added in v0.15.3
func HashPassword ¶ added in v0.20.6
HashPassword returns the argon2id PHC hash of the password, with a fresh random salt: $argon2id$v=19$m=19456,t=2,p=1$<salt>$<hash>
func IsBcryptHash ¶ added in v0.20.6
IsBcryptHash reports whether the value has a bcrypt prefix
func IsPasswordHash ¶ added in v0.20.6
IsPasswordHash reports whether the value is a hash VerifyPassword can check
func NeedsRehash ¶ added in v0.20.6
NeedsRehash reports whether a stored hash should be replaced by HashPassword of the same password: bcrypt, or argon2id with parameters other than the current defaults
func ValidatePassword ¶ added in v0.20.6
ValidatePassword enforces the password policy for a builtin user
func VerifyPassword ¶ added in v0.20.6
VerifyPassword checks the password against a stored hash (argon2id PHC or bcrypt). A wrong password returns false with a nil error; an unparseable hash returns an error
Types ¶
This section is empty.
Source Files