From e7443a7600fe6ce9fcb2692714db290254cb32ac Mon Sep 17 00:00:00 2001
From: Rose Hogenson <rhogenson@google.com>
Date: Wed, 24 Sep 2025 08:40:19 -0700
Subject: Use PBKDF2-HMAC-SHA512 for key derivation

---
 internal/pwhash/pwhash.go | 26 +++++++-------------------
 roseh.moe.go              | 21 ++++-----------------
 2 files changed, 11 insertions(+), 36 deletions(-)

diff --git a/internal/pwhash/pwhash.go b/internal/pwhash/pwhash.go
index f343d70..3074b0c 100644
--- a/internal/pwhash/pwhash.go
+++ b/internal/pwhash/pwhash.go
@@ -1,36 +1,24 @@
 package pwhash
 
 import (
-	"crypto/hkdf"
 	"crypto/pbkdf2"
-	"crypto/sha256"
 	"crypto/sha512"
-	"fmt"
 )
 
-const SaltLen = sha256.Size + sha512.Size
+const SaltLen = sha512.Size
 
-const defaultIterations = 3670016 // from cmd/finditers
+const defaultIterations = 903636 // from cmd/finditers
 
 func HashIter(password string, salt []byte, iter int) ([]byte, error) {
-	return pbkdf2.Key(sha256.New, password, salt, iter, sha256.Size)
+	return pbkdf2.Key(sha512.New, password, salt, iter, sha512.Size)
 }
 
 func Hash(password string, salt []byte) (key, pwHash []byte, err error) {
-	if len(salt) != SaltLen {
-		return nil, nil, fmt.Errorf("bad salt size")
-	}
-	hashedPassword, err := HashIter(password, salt[:sha256.Size], defaultIterations)
-	if err != nil {
-		return nil, nil, err
-	}
-	key, err = hkdf.Extract(sha512.New, hashedPassword, salt[sha256.Size:])
-	if err != nil {
-		return nil, nil, err
-	}
-	pwHash, err = hkdf.Expand(sha512.New, key, "auth", sha512.Size)
+	const aesKeySize = 32
+
+	key, err = HashIter(password, salt, defaultIterations)
 	if err != nil {
 		return nil, nil, err
 	}
-	return key, pwHash, nil
+	return key[:aesKeySize], key[aesKeySize:], nil
 }
diff --git a/roseh.moe.go b/roseh.moe.go
index 044ae01..161c157 100644
--- a/roseh.moe.go
+++ b/roseh.moe.go
@@ -4,7 +4,6 @@ import (
 	"bytes"
 	"crypto/aes"
 	"crypto/cipher"
-	"crypto/hkdf"
 	"crypto/hmac"
 	"crypto/rand"
 	"crypto/sha512"
@@ -220,9 +219,7 @@ type loginTemplateArgs struct {
 }
 
 func login(w http.ResponseWriter, r *http.Request) {
-	const aesKeySize = 32
-
-	rawKey, pwHash, err := pwhash.Hash(r.FormValue("password"), notepadPasswordSalt)
+	key, pwHash, err := pwhash.Hash(r.FormValue("password"), notepadPasswordSalt)
 	if err != nil {
 		http.Error(w, fmt.Sprintf("Unable to hash password: %s", err), http.StatusInternalServerError)
 		return
@@ -234,20 +231,10 @@ func login(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	encryptionKeyMu.Lock()
-	currentKey := encryptionKey
-	encryptionKeyMu.Unlock()
-	if currentKey == nil {
-		key, err := hkdf.Expand(sha512.New, rawKey, "encrypt", aesKeySize)
-		if err != nil {
-			http.Error(w, fmt.Sprintf("Unable to derive encryption key: %s", err), http.StatusInternalServerError)
-			return
-		}
-		encryptionKeyMu.Lock()
-		if encryptionKey == nil {
-			encryptionKey = key
-		}
-		encryptionKeyMu.Unlock()
+	if encryptionKey == nil {
+		encryptionKey = key
 	}
+	encryptionKeyMu.Unlock()
 	attachCookie(w)
 	http.Redirect(w, r, r.FormValue("redirect"), http.StatusSeeOther)
 }
-- 
cgit v1.3.1