c60cc7ca75
Some checks failed
CI / Run tests and lints (push) Failing after 29s
CI / Build CLI docs (push) Has been skipped
CI / Run Playwright end-to-end tests (mysql) (push) Failing after 3s
CI / Run Playwright end-to-end tests (postgres) (push) Failing after 2s
CI / Run Playwright end-to-end tests (sqlite) (push) Failing after 3s
CodeQL / Analyze (go) (push) Failing after 4s
CodeQL / Analyze (javascript) (push) Failing after 3s
Docker Image Scanners / scanners (push) Failing after 4s
Synchronize Issue Labels / Synchronize Issue Labels (push) Has been skipped
CI / Run end-to-end tests (postgres) (push) Failing after 19s
CI / Run end-to-end tests (sqlite) (push) Failing after 2s
CI / Run Playwright end-to-end tests (cockroach) (push) Failing after 2s
CI / Draft newsletter (push) Has been skipped
CI / Generate release (push) Has been skipped
CI / Pending approval Slack notification (push) Has been skipped
CI / Send newsletter (push) Has been skipped
104 lines
2.4 KiB
Go
104 lines
2.4 KiB
Go
package hasherx
|
|
|
|
import (
|
|
"bytes"
|
|
"context"
|
|
"crypto/rand"
|
|
"crypto/sha1" // #nosec G505 - compatibility for imported passwords
|
|
"crypto/sha256"
|
|
"crypto/sha512"
|
|
"encoding/base64"
|
|
"fmt"
|
|
"hash"
|
|
|
|
"github.com/pkg/errors"
|
|
"go.opentelemetry.io/otel"
|
|
"go.opentelemetry.io/otel/codes"
|
|
"golang.org/x/crypto/pbkdf2"
|
|
"golang.org/x/crypto/sha3"
|
|
|
|
"github.com/ory/x/otelx"
|
|
)
|
|
|
|
type (
|
|
// PBKDF2 is a PBKDF2 hasher.
|
|
PBKDF2 struct {
|
|
c PBKDF2Configurator
|
|
}
|
|
|
|
// PBKDF2Config is the configuration for a PBKDF2 hasher.
|
|
PBKDF2Config struct {
|
|
// Algorithm can be one of sha1, sha224, sha256, sha384, sha512
|
|
Algorithm string
|
|
// Iterations is the number of iterations to use.
|
|
Iterations uint32
|
|
// KeyLength is the length of the salt.
|
|
SaltLength uint32
|
|
// KeyLength is the length of the key.
|
|
KeyLength uint32
|
|
}
|
|
|
|
// PBKDF2Configurator is a configurator for a PBKDF2 hasher.
|
|
PBKDF2Configurator interface {
|
|
HasherPBKDF2Config(ctx context.Context) *PBKDF2Config
|
|
}
|
|
)
|
|
|
|
// NewHasherPBKDF2 creates a new PBKDF2 hasher.
|
|
func NewHasherPBKDF2(c PBKDF2Configurator) *PBKDF2 {
|
|
return &PBKDF2{c: c}
|
|
}
|
|
|
|
// Generate generates a hash for the given password.
|
|
func (h *PBKDF2) Generate(ctx context.Context, password []byte) (hash []byte, err error) {
|
|
ctx, span := otel.GetTracerProvider().Tracer("").Start(ctx, "hash.PBKDF2.Generate")
|
|
defer otelx.End(span, &err)
|
|
|
|
conf := h.c.HasherPBKDF2Config(ctx)
|
|
salt := make([]byte, conf.SaltLength)
|
|
if _, err := rand.Read(salt); err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
key := pbkdf2.Key(password, salt, int(conf.Iterations), int(conf.KeyLength), getPseudorandomFunctionForPbkdf2(conf.Algorithm))
|
|
|
|
var b bytes.Buffer
|
|
if _, err := fmt.Fprintf(
|
|
&b,
|
|
"$pbkdf2-%s$i=%d,l=%d$%s$%s",
|
|
conf.Algorithm,
|
|
conf.Iterations,
|
|
conf.KeyLength,
|
|
base64.RawStdEncoding.EncodeToString(salt),
|
|
base64.RawStdEncoding.EncodeToString(key),
|
|
); err != nil {
|
|
span.RecordError(err)
|
|
span.SetStatus(codes.Error, err.Error())
|
|
return nil, errors.WithStack(err)
|
|
}
|
|
|
|
return b.Bytes(), nil
|
|
}
|
|
|
|
// Understands checks if the given hash is in the correct format.
|
|
func (h *PBKDF2) Understands(hash []byte) bool {
|
|
return IsPbkdf2Hash(hash)
|
|
}
|
|
|
|
func getPseudorandomFunctionForPbkdf2(alg string) func() hash.Hash {
|
|
switch alg {
|
|
case "sha1":
|
|
return sha1.New
|
|
case "sha224":
|
|
return sha3.New224
|
|
case "sha256":
|
|
return sha256.New
|
|
case "sha384":
|
|
return sha3.New384
|
|
case "sha512":
|
|
return sha512.New
|
|
default:
|
|
return sha256.New
|
|
}
|
|
}
|