47 lines
1.0 KiB
Go
47 lines
1.0 KiB
Go
package bootstrapconfig
|
|
|
|
import (
|
|
"crypto/rand"
|
|
"crypto/sha512"
|
|
"encoding/base64"
|
|
"strings"
|
|
|
|
"golang.org/x/crypto/pbkdf2"
|
|
)
|
|
|
|
var (
|
|
encoding = base64.RawStdEncoding
|
|
)
|
|
|
|
func PasswordHashFromSeed(seed, pass []byte) string {
|
|
h := pbkdf2.Key(pass, seed, 2048, 32, sha512.New)
|
|
return encoding.EncodeToString(h)
|
|
}
|
|
|
|
func PasswordHash(pass []byte) (hashedPassWithSeed string) {
|
|
seed := make([]byte, 10) // 8 bytes min by the RFC recommendation
|
|
_, err := rand.Read(seed)
|
|
if err != nil {
|
|
panic(err) // we do not expect this to fail...
|
|
}
|
|
return JoinSeedAndHash(seed, PasswordHashFromSeed(seed, pass))
|
|
}
|
|
|
|
func JoinSeedAndHash(seed []byte, hash string) string {
|
|
return encoding.EncodeToString(seed) + ":" + hash
|
|
}
|
|
|
|
func CheckPassword(hashedPassWithSeed string, pass []byte) (ok bool) {
|
|
parts := strings.SplitN(hashedPassWithSeed, ":", 2)
|
|
|
|
encodedSeed := parts[0]
|
|
encodedHash := parts[1]
|
|
|
|
seed, err := encoding.DecodeString(encodedSeed)
|
|
if err != nil {
|
|
return false
|
|
}
|
|
|
|
return encodedHash == PasswordHashFromSeed(seed, pass)
|
|
}
|