Simplify the password hash and get rid of pbkdf2

Since the password already has 16 bytes of security, pbkdf2 isn't
necessary here. We can use a simple sha256. I promise to pick a
secure password.

1 files changed, 6 insertions, 5 deletions

diff --git a/roseh.moe.go b/roseh.moe.go
index 64d5e83..ffca9d5 100644
--- a/roseh.moe.go
+++ b/roseh.moe.go
@@ -25,7 +25,6 @@ import (
 
 	"github.com/skip2/go-qrcode"
 	"roseh.moe/pkg/ccl"
-	"roseh.moe/pkg/roseh.moe/internal/pwhash"
 	"roseh.moe/pkg/wordlist"
 )
 
@@ -40,6 +39,8 @@ var (
 	serverStartTime = time.Now()
 )
 
+const targetSecurityLevel = 16
+
 var notepadPassword, secretKey []byte
 
 func loadSecrets() error {
@@ -322,7 +323,7 @@ func wormholeQR(w http.ResponseWriter, r *http.Request) {
 	w.Write(qr)
 }
 
-const macSize = 16 // sorry
+const macSize = targetSecurityLevel
 
 func mac(msg []byte) []byte {
 	mac := hmac.New(sha256.New, secretKey)
@@ -473,9 +474,9 @@ func checkCSRFToken(r *http.Request) error {
 }
 
 func checkPassword(password string) bool {
-	expectedHash, salt := notepadPassword[:len(notepadPassword)-pwhash.SaltSize], notepadPassword[len(notepadPassword)-pwhash.SaltSize:]
-	hash, err := pwhash.Hash(password, salt)
-	return err == nil && subtle.ConstantTimeCompare(hash, expectedHash) != 0
+	const pwHashSize = targetSecurityLevel
+	hash := sha256.Sum256([]byte(password))
+	return subtle.ConstantTimeCompare(hash[:pwHashSize], notepadPassword) != 0
 }
 
 var (