Use pbkdf2 for password hashing instead of sha512

1 files changed, 22 insertions, 0 deletions

diff --git a/internal/pwhash/pwhash.go b/internal/pwhash/pwhash.go
new file mode 100644
index 0000000..a17ed2e
--- /dev/null
+++ b/internal/pwhash/pwhash.go
@@ -0,0 +1,22 @@
+package pwhash
+
+import (
+	"crypto/pbkdf2"
+	"crypto/sha256"
+	"crypto/sha512"
+)
+
+const defaultIterations = 3670016 // from cmd/finditers
+
+func HashIter(password string, salt []byte, iter int) ([]byte, error) {
+	return pbkdf2.Key(sha256.New, password, salt, iter, 32)
+}
+
+func Hash(password string, salt []byte) ([]byte, error) {
+	hashed, err := HashIter(password, salt, defaultIterations)
+	if err != nil {
+		return nil, err
+	}
+	sha := sha512.Sum512(hashed)
+	return sha[:], nil
+}