From 0d640e791493de79b43b050a13b1cf9c081854ec Mon Sep 17 00:00:00 2001 From: Rose Hogenson Date: Fri, 21 Nov 2025 18:44:58 -0800 Subject: Simplify the password hash and get rid of pbkdf2 Since the password already has 16 bytes of security, pbkdf2 isn't necessary here. We can use a simple sha256. I promise to pick a secure password. --- roseh.moe.go | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) (limited to 'roseh.moe.go') diff --git a/roseh.moe.go b/roseh.moe.go index 64d5e83..ffca9d5 100644 --- a/roseh.moe.go +++ b/roseh.moe.go @@ -25,7 +25,6 @@ import ( "github.com/skip2/go-qrcode" "roseh.moe/pkg/ccl" - "roseh.moe/pkg/roseh.moe/internal/pwhash" "roseh.moe/pkg/wordlist" ) @@ -40,6 +39,8 @@ var ( serverStartTime = time.Now() ) +const targetSecurityLevel = 16 + var notepadPassword, secretKey []byte func loadSecrets() error { @@ -322,7 +323,7 @@ func wormholeQR(w http.ResponseWriter, r *http.Request) { w.Write(qr) } -const macSize = 16 // sorry +const macSize = targetSecurityLevel func mac(msg []byte) []byte { mac := hmac.New(sha256.New, secretKey) @@ -473,9 +474,9 @@ func checkCSRFToken(r *http.Request) error { } func checkPassword(password string) bool { - expectedHash, salt := notepadPassword[:len(notepadPassword)-pwhash.SaltSize], notepadPassword[len(notepadPassword)-pwhash.SaltSize:] - hash, err := pwhash.Hash(password, salt) - return err == nil && subtle.ConstantTimeCompare(hash, expectedHash) != 0 + const pwHashSize = targetSecurityLevel + hash := sha256.Sum256([]byte(password)) + return subtle.ConstantTimeCompare(hash[:pwHashSize], notepadPassword) != 0 } var ( -- cgit v1.3.1