pbkdf2

README

go-pbkdf2

PBKDF2 password hashing and verification for Go.

Install

go get github.com/isayme/go-pbkdf2

Usage

Hash a password

hashed, err := pbkdf2.Hash("your plain password", pbkdf2.DefaultParams)
if err != nil {
    log.Fatal(err)
}

Verify a password

ok, err := pbkdf2.Verify("your plain password", hashed)
if err != nil {
    log.Fatal(err)
}
if !ok {
    log.Fatal("invalid password")
}

Custom params

params := pbkdf2.Params{
    Iterations: 100000,
    KeyLen:     32,
    SaltLen:    16,
    Digest:     "sha256",
}

hashed, err := pbkdf2.Hash("password", params)

Hash format

$pbkdf2-<digest>$i=<iterations>$<salt>$<key>

Field	Description
digest	Hash function (sha256, sha512)
iterations	Number of iterations
salt	Random salt (base64 encoded)
key	Derived key (base64 encoded)

Test

go test -v ./...

Documentation

Index

• Variables
• func Hash(password string, params Params) (string, error)
• func Verify(password, hashed string) (bool, error)
• type Params

Variables

var DefaultParams = Params{
	Iterations: 100000,
	Digest:     "sha256",
	KeyLen:     32,
	SaltLen:    16,
}

DefaultParams returns the recommended default PBKDF2 parameters. Iterations=100000, KeyLen=32

Functions

func Hash

func Hash(password string, params Params) (string, error)

Hash generates a PBKDF2 hash of the password with the given parameters. The hash format is $pbkdf2-<digest>$i=<iterations>$<salt>$<key>.

func Verify

func Verify(password, hashed string) (bool, error)

Verify checks if the password matches the hashed value. It uses constant-time comparison to prevent timing attacks.

Types

type Params

type Params struct {
	// Iterations is the number of iterations.
	Iterations int
	// Digest is the hash function to use. Supported values: sha1, sha256, sha512.
	Digest string

	// SaltLen is the length of the salt.
	SaltLen int
	// KeyLen is the length of the derived key.
	KeyLen int
}

Params defines the PBKDF2 algorithm parameters.