Combine password hash and salt secrets

3 files changed, 6 insertions, 8 deletions

diff --git a/cmd/hashpw/hashpw.go b/cmd/hashpw/hashpw.go
index 6a84fc5..5bc740d 100644
--- a/cmd/hashpw/hashpw.go
+++ b/cmd/hashpw/hashpw.go
@@ -16,13 +16,13 @@ func run() error {
 	if err != nil {
 		return err
 	}
-	salt := make([]byte, 32)
+	salt := make([]byte, pwhash.SaltLen)
 	rand.Read(salt)
 	_, hashedPassword, err := pwhash.Hash(string(password), salt)
 	if err != nil {
 		return err
 	}
-	fmt.Printf("notepad-password=%x\nsalt=%x\n", hashedPassword, salt)
+	fmt.Printf("notepad-password=%x%x\n", salt, hashedPassword)
 	return nil
 }
 
diff --git a/internal/pwhash/pwhash.go b/internal/pwhash/pwhash.go
index 7bc62d4..97ce199 100644
--- a/internal/pwhash/pwhash.go
+++ b/internal/pwhash/pwhash.go
@@ -6,6 +6,8 @@ import (
 	"crypto/sha512"
 )
 
+const SaltLen = 32
+
 const defaultIterations = 3670016 // from cmd/finditers
 
 func HashIter(password string, salt []byte, iter int) ([]byte, error) {
diff --git a/roseh.moe.go b/roseh.moe.go
index c75acca..f24bc58 100644
--- a/roseh.moe.go
+++ b/roseh.moe.go
@@ -50,15 +50,11 @@ func loadSecrets() error {
 	}
 	for _, line := range bytes.Split(bytes.TrimSuffix(secrets, []byte("\n")), []byte("\n")) {
 		if pw, ok := bytes.CutPrefix(line, []byte("notepad-password=")); ok {
-			notepadPassword = make([]byte, hex.DecodedLen(len(pw)))
+			buf := make([]byte, hex.DecodedLen(len(pw)))
 			if _, err := hex.Decode(notepadPassword, pw); err != nil {
 				return err
 			}
-		} else if salt, ok := bytes.CutPrefix(line, []byte("salt=")); ok {
-			notepadPasswordSalt = make([]byte, hex.DecodedLen(len(salt)))
-			if _, err := hex.Decode(notepadPasswordSalt, salt); err != nil {
-				return err
-			}
+			notepadPasswordSalt, notepadPassword = buf[:pwhash.SaltLen], buf[pwhash.SaltLen:]
 		} else if key, ok := bytes.CutPrefix(line, []byte("secret-key=")); ok {
 			if hex.DecodedLen(len(key)) != sha512.Size256 {
 				return fmt.Errorf("invalid HMAC-SHA512/256 key")