Documentation
¶
Overview ¶
Package password provides password hashing helpers with safe defaults.
Index ¶
Constants ¶
const ( BcryptInteractiveCost = 10 BcryptBalancedCost = 12 BcryptHighCost = 14 )
BcryptInteractiveCost is the low-latency bcrypt cost. BcryptBalancedCost is the general-purpose bcrypt cost. BcryptHighCost is the high-security bcrypt cost.
Variables ¶
var ( // ErrInvalidParams indicates that the provided password parameters are invalid. ErrInvalidParams = ewrap.New("invalid password parameters") // ErrInvalidHash indicates that the provided password hash is invalid. ErrInvalidHash = ewrap.New("invalid password hash") // ErrPasswordTooLong indicates that the provided password is too long. ErrPasswordTooLong = ewrap.New("password is too long") )
Functions ¶
func ConstantTimeCompare ¶
ConstantTimeCompare compares two byte slices in constant time.
Types ¶
type Argon2idHasher ¶
type Argon2idHasher struct {
// contains filtered or unexported fields
}
Argon2idHasher hashes passwords using argon2id.
func NewArgon2id ¶
func NewArgon2id(params Argon2idParams) (*Argon2idHasher, error)
NewArgon2id constructs a hasher with custom parameters.
type Argon2idParams ¶
type Argon2idParams struct {
Memory uint32
Time uint32
Threads uint8
SaltLength uint32
KeyLength uint32
}
Argon2idParams defines parameters for argon2id hashing.
func Argon2idBalanced ¶
func Argon2idBalanced() Argon2idParams
Argon2idBalanced returns balanced parameters for general use.
func Argon2idHighSecurity ¶
func Argon2idHighSecurity() Argon2idParams
Argon2idHighSecurity returns parameters for high-security environments.
func Argon2idInteractive ¶
func Argon2idInteractive() Argon2idParams
Argon2idInteractive returns parameters suitable for latency-sensitive flows.
type BcryptHasher ¶
type BcryptHasher struct {
// contains filtered or unexported fields
}
BcryptHasher hashes passwords using bcrypt.
func NewBcrypt ¶
func NewBcrypt(cost int) (*BcryptHasher, error)
NewBcrypt constructs a bcrypt hasher with the given cost.
type Hasher ¶
type Hasher interface {
Hash(password []byte) (string, error)
// Verify checks whether password matches the encoded hash.
// It returns:
// - bool: true if the password matches the encoded hash.
// - bool: true if the hash should be rehashed with updated parameters.
Verify(password []byte, encoded string) (bool, bool, error)
}
Hasher defines a password hashing interface with upgrade detection.
Source Files