From e7443a7600fe6ce9fcb2692714db290254cb32ac Mon Sep 17 00:00:00 2001
From: Rose Hogenson <rhogenson@google.com>
Date: Wed, 24 Sep 2025 08:40:19 -0700
Subject: Use PBKDF2-HMAC-SHA512 for key derivation

---
 roseh.moe.go | 21 ++++-----------------
 1 file changed, 4 insertions(+), 17 deletions(-)

(limited to 'roseh.moe.go')

diff --git a/roseh.moe.go b/roseh.moe.go
index 044ae01..161c157 100644
--- a/roseh.moe.go
+++ b/roseh.moe.go
@@ -4,7 +4,6 @@ import (
 	"bytes"
 	"crypto/aes"
 	"crypto/cipher"
-	"crypto/hkdf"
 	"crypto/hmac"
 	"crypto/rand"
 	"crypto/sha512"
@@ -220,9 +219,7 @@ type loginTemplateArgs struct {
 }
 
 func login(w http.ResponseWriter, r *http.Request) {
-	const aesKeySize = 32
-
-	rawKey, pwHash, err := pwhash.Hash(r.FormValue("password"), notepadPasswordSalt)
+	key, pwHash, err := pwhash.Hash(r.FormValue("password"), notepadPasswordSalt)
 	if err != nil {
 		http.Error(w, fmt.Sprintf("Unable to hash password: %s", err), http.StatusInternalServerError)
 		return
@@ -234,20 +231,10 @@ func login(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	encryptionKeyMu.Lock()
-	currentKey := encryptionKey
-	encryptionKeyMu.Unlock()
-	if currentKey == nil {
-		key, err := hkdf.Expand(sha512.New, rawKey, "encrypt", aesKeySize)
-		if err != nil {
-			http.Error(w, fmt.Sprintf("Unable to derive encryption key: %s", err), http.StatusInternalServerError)
-			return
-		}
-		encryptionKeyMu.Lock()
-		if encryptionKey == nil {
-			encryptionKey = key
-		}
-		encryptionKeyMu.Unlock()
+	if encryptionKey == nil {
+		encryptionKey = key
 	}
+	encryptionKeyMu.Unlock()
 	attachCookie(w)
 	http.Redirect(w, r, r.FormValue("redirect"), http.StatusSeeOther)
 }
-- 
cgit v1.3.1