From bcbb629db87b6bc0e9a7880ec4ee1c90d284a6c7 Mon Sep 17 00:00:00 2001 From: Rose Hogenson Date: Sun, 5 Oct 2025 21:58:44 -0700 Subject: Bring back the notepad --- internal/pwhash/pwhash.go | 44 ++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 44 insertions(+) create mode 100644 internal/pwhash/pwhash.go (limited to 'internal/pwhash/pwhash.go') diff --git a/internal/pwhash/pwhash.go b/internal/pwhash/pwhash.go new file mode 100644 index 0000000..c3c11ff --- /dev/null +++ b/internal/pwhash/pwhash.go @@ -0,0 +1,44 @@ +package pwhash + +import ( + "crypto/pbkdf2" + "crypto/rand" + "crypto/sha512" + "crypto/subtle" + "errors" +) + +const defaultIter = 12504615 // from tools/finditers + +func HashIter(pw string, salt []byte, iter int) ([]byte, error) { + return pbkdf2.Key(sha512.New, pw, salt, iter, 32) +} + +func Hash(pw string) ([]byte, error) { + buf := make([]byte, 40) + salt := buf[32:] + rand.Read(salt) + hash, err := HashIter(pw, salt, defaultIter) + if err != nil { + return nil, err + } + copy(buf, hash) + return buf, nil +} + +var errBadPassword = errors.New("bad password") + +func Check(pwHash []byte, pw string) error { + if len(pwHash) < 32 { + return errBadPassword + } + wantHash, salt := pwHash[:32], pwHash[32:] + gotHash, err := HashIter(pw, salt, defaultIter) + if err != nil { + return err + } + if subtle.ConstantTimeCompare(gotHash, wantHash) == 0 { + return errBadPassword + } + return nil +} -- cgit v1.3.1