From e7443a7600fe6ce9fcb2692714db290254cb32ac Mon Sep 17 00:00:00 2001 From: Rose Hogenson Date: Wed, 24 Sep 2025 08:40:19 -0700 Subject: Use PBKDF2-HMAC-SHA512 for key derivation --- internal/pwhash/pwhash.go | 26 +++++++------------------- 1 file changed, 7 insertions(+), 19 deletions(-) (limited to 'internal/pwhash/pwhash.go') diff --git a/internal/pwhash/pwhash.go b/internal/pwhash/pwhash.go index f343d70..3074b0c 100644 --- a/internal/pwhash/pwhash.go +++ b/internal/pwhash/pwhash.go @@ -1,36 +1,24 @@ package pwhash import ( - "crypto/hkdf" "crypto/pbkdf2" - "crypto/sha256" "crypto/sha512" - "fmt" ) -const SaltLen = sha256.Size + sha512.Size +const SaltLen = sha512.Size -const defaultIterations = 3670016 // from cmd/finditers +const defaultIterations = 903636 // from cmd/finditers func HashIter(password string, salt []byte, iter int) ([]byte, error) { - return pbkdf2.Key(sha256.New, password, salt, iter, sha256.Size) + return pbkdf2.Key(sha512.New, password, salt, iter, sha512.Size) } func Hash(password string, salt []byte) (key, pwHash []byte, err error) { - if len(salt) != SaltLen { - return nil, nil, fmt.Errorf("bad salt size") - } - hashedPassword, err := HashIter(password, salt[:sha256.Size], defaultIterations) - if err != nil { - return nil, nil, err - } - key, err = hkdf.Extract(sha512.New, hashedPassword, salt[sha256.Size:]) - if err != nil { - return nil, nil, err - } - pwHash, err = hkdf.Expand(sha512.New, key, "auth", sha512.Size) + const aesKeySize = 32 + + key, err = HashIter(password, salt, defaultIterations) if err != nil { return nil, nil, err } - return key, pwHash, nil + return key[:aesKeySize], key[aesKeySize:], nil } -- cgit v1.3.1