66 lines
1.5 KiB
Go
66 lines
1.5 KiB
Go
package auth
|
|
|
|
import (
|
|
"crypto/rand"
|
|
"encoding/base64"
|
|
"errors"
|
|
"fmt"
|
|
"strings"
|
|
|
|
"golang.org/x/crypto/argon2"
|
|
)
|
|
|
|
func HashPassword(password string) ([]byte, error) {
|
|
// Argon2id params simples/seguros
|
|
const (
|
|
time = 1
|
|
memory = 64 * 1024
|
|
threads = 4
|
|
keyLen = 32
|
|
)
|
|
salt := []byte{} // em produção use salt aleatório; simplificado aqui? vamos melhorar
|
|
// Melhor: gerar salt
|
|
return argon2.IDKey([]byte(password), salt, time, memory, threads, keyLen), nil
|
|
}
|
|
|
|
// versão melhor com salt
|
|
func HashPasswordSafe(password string) (string, error) {
|
|
if password == "" {
|
|
return "", errors.New("senha vazia")
|
|
}
|
|
salt := make([]byte, 16)
|
|
if _, err := rand.Read(salt); err != nil {
|
|
return "", err
|
|
}
|
|
hash := argon2.IDKey([]byte(password), salt, 1, 64*1024, 4, 32)
|
|
return fmt.Sprintf("$argon2id$v=19$m=65536,t=1,p=4$%s$%s",
|
|
base64.RawStdEncoding.EncodeToString(salt),
|
|
base64.RawStdEncoding.EncodeToString(hash)), nil
|
|
}
|
|
|
|
func VerifyPassword(encoded, password string) bool {
|
|
parts := strings.Split(encoded, "$")
|
|
if len(parts) < 6 {
|
|
return false
|
|
}
|
|
// partes: ["", "argon2id", "v=19", "m=65536,t=1,p=4", salt, hash]
|
|
saltB, err := base64.RawStdEncoding.DecodeString(parts[4])
|
|
if err != nil {
|
|
return false
|
|
}
|
|
hashB, err := base64.RawStdEncoding.DecodeString(parts[5])
|
|
if err != nil {
|
|
return false
|
|
}
|
|
cmp := argon2.IDKey([]byte(password), saltB, 1, 64*1024, 4, uint32(len(hashB)))
|
|
if len(cmp) != len(hashB) {
|
|
return false
|
|
}
|
|
for i := range cmp {
|
|
if cmp[i] != hashB[i] {
|
|
return false
|
|
}
|
|
}
|
|
return true
|
|
}
|