1 files changed, 10 insertions, 16 deletions
diff --git a/roseh.moe.go b/roseh.moe.go
index 140b1de..d3e96bf 100644
--- a/roseh.moe.go
+++ b/roseh.moe.go
@@ -8,7 +8,6 @@ import (
 	"crypto/subtle"
 	"embed"
 	"encoding/base64"
-	"encoding/binary"
 	"encoding/hex"
 	"flag"
 	"fmt"
@@ -21,7 +20,8 @@ import (
 	"sync"
 	"time"
 
-	"gitlab.com/rhogenson/roseh.moe/internal/wordlist"
+	"gitlab.com/rhogenson/roseh.moe/internal/hole"
+	"gitlab.com/rhogenson/roseh.moe/internal/pwhash"
 )
 
 var (
@@ -131,19 +131,8 @@ type wormholeTemplateArgs struct {
 	Hole string
 }
 
-func makeHole() string {
-	const nWords = 10
-	buf := make([]byte, 2*nWords)
-	rand.Read(buf)
-	words := make([]string, nWords)
-	for i := range words {
-		words[i] = wordlist.Words[binary.NativeEndian.Uint16(buf[2*i:])&0x1fff]
-	}
-	return strings.Join(words, "-")
-}
-
 func wormhole(w http.ResponseWriter, r *http.Request) {
-	if err := wormholeTemplate.Execute(w, wormholeTemplateArgs{Self: *selfURL, Hole: makeHole()}); err != nil {
+	if err := wormholeTemplate.Execute(w, wormholeTemplateArgs{Self: *selfURL, Hole: hole.New()}); err != nil {
 		log.Printf("Warning: wormhole: %s", err)
 	}
 }
@@ -358,6 +347,12 @@ func checkCSRFToken(r *http.Request) error {
 	return nil
 }
 
+func checkPassword(password string) bool {
+	expectedHash, salt := notepadPassword[:len(notepadPassword)-pwhash.SaltSize], notepadPassword[len(notepadPassword)-pwhash.SaltSize:]
+	hash, err := pwhash.Hash(password, salt)
+	return err == nil && subtle.ConstantTimeCompare(hash, expectedHash) != 0
+}
+
 var (
 	//go:embed templates/login.html.template
 	loginTemplateString string
@@ -380,8 +375,7 @@ func login(w http.ResponseWriter, r *http.Request) {
 		http.Error(w, "bad CSRF token", http.StatusBadRequest)
 		return
 	}
-	hash := sha256.Sum256([]byte(r.FormValue("password")))
-	if subtle.ConstantTimeCompare(notepadPassword, hash[:]) == 0 {
+	if !checkPassword(r.FormValue("password")) {
 		if err := loginTemplate.Execute(w, loginTemplateArgs{
 			Error:     true,
 			CSRFToken: r.FormValue("csrf-token"),