Use HKDF to expand key into both auth and encrypt

I guess having the password hash depend on the encryption key isn't a great idea. Let's make them independent using hkdf

1 files changed, 18 insertions, 6 deletions

diff --git a/internal/pwhash/pwhash.go b/internal/pwhash/pwhash.go
index 97ce199..f343d70 100644
--- a/internal/pwhash/pwhash.go
+++ b/internal/pwhash/pwhash.go
@@ -1,24 +1,36 @@
 package pwhash
 
 import (
+	"crypto/hkdf"
 	"crypto/pbkdf2"
 	"crypto/sha256"
 	"crypto/sha512"
+	"fmt"
 )
 
-const SaltLen = 32
+const SaltLen = sha256.Size + sha512.Size
 
 const defaultIterations = 3670016 // from cmd/finditers
 
 func HashIter(password string, salt []byte, iter int) ([]byte, error) {
-	return pbkdf2.Key(sha256.New, password, salt, iter, 32)
+	return pbkdf2.Key(sha256.New, password, salt, iter, sha256.Size)
 }
 
-func Hash(password string, salt []byte) (key, pwhash []byte, err error) {
-	hashed, err := HashIter(password, salt, defaultIterations)
+func Hash(password string, salt []byte) (key, pwHash []byte, err error) {
+	if len(salt) != SaltLen {
+		return nil, nil, fmt.Errorf("bad salt size")
+	}
+	hashedPassword, err := HashIter(password, salt[:sha256.Size], defaultIterations)
+	if err != nil {
+		return nil, nil, err
+	}
+	key, err = hkdf.Extract(sha512.New, hashedPassword, salt[sha256.Size:])
+	if err != nil {
+		return nil, nil, err
+	}
+	pwHash, err = hkdf.Expand(sha512.New, key, "auth", sha512.Size)
 	if err != nil {
 		return nil, nil, err
 	}
-	sha := sha512.Sum512(hashed)
-	return hashed, sha[:], nil
+	return key, pwHash, nil
 }