password

README

password

Implemented schemas

Safe schemas

• SHA256-CRYPT $5$ https://www.akkadia.org/drepper/sha-crypt.html
• SHA512-CRYPT $6$ https://www.akkadia.org/drepper/sha-crypt.html
• BLF-CRYPT / BCRYPT $2a$, $2$, $2x$, $2y$, $2b$

Unsafe schemas

• MD5-CRYPT $1$
• APR1 $apr1$

BLF-CRYPT apparent mess

BCrypt algorithm is secure but there was flaws in few implementations. This is the summary of the explanation of the different flavors of bcrypt :

• $2$ may be produced by a buggy version who doesn't cope with UNICODE
• $2x$ is the PHP name for buggy $2$
• $2y$ is the PHP name of $2a$
• $2b$ is the bcrypt prefix used in OpendBSD for the corrected version of $2a$ (password length was limited to 255 bytes)

License

BSD-2

Documentation

Index

• Variables
• func Register(def ...Definition)
• func Set(pwd string) error
• func SetDefault(def Definition)
• type Crypter
  • func CrypterFound() Crypter
• type Definition
• type Factory
  • func (c *Factory) CrypterFound() Crypter
  • func (c *Factory) FlagHelper() string
  • func (c *Factory) MarshalText() ([]byte, error)
  • func (c *Factory) Register(def ...Definition)
  • func (c *Factory) Set(pwd string) error
  • func (c *Factory) SetDefault(def Definition)
  • func (c *Factory) String() string
  • func (c *Factory) UnmarshalText(text []byte) error

Examples

• Factory
• Factory.UnmarshalText

Variables

var (
	NoMatchingDef       error = errors.New("No Matching Definition Found")
	ERR_NOPE            error = errors.New("NOPE")
	ErrUnknownMD5Prefix error = errors.New("Unknown MD5-CRYPT Prefix")
)

var BCRYPT = register(bcryptdriver{bcryptPrefix[0], bcryptDefCost})

BCRYPT is the exported driver for BLF-CRYPT

var SHA256 = register(sha256driver{sha256DefRounds})

SHA256 is the exported driver for SHA256-CRYPT

var SHA512 = register(sha512driver{sha512DefRounds})

SHA512 is the exported driver for SHA512-CRYPT

Functions

func Register

func Register(def ...Definition)

Register register the definition of a new crypter

func Set

func Set(pwd string) error

Set is a default implementation of `Crypt.Set(string) error`

func SetDefault

func SetDefault(def Definition)

SetDefault define a default crypter

Types

type Crypter

type Crypter interface {
	Salt(salt []byte) Crypter
	Hashed(pwd []byte) Crypter
	Crypt(pwd []byte) Crypter
	Verify(pwd []byte) bool
	Options() map[string]interface{}
	Definition() Definition
	encoding.TextMarshaler
	flag.Value
}

Crypter is the public interface for an instancied Definition

func CrypterFound

func CrypterFound() Crypter

type Definition

type Definition interface {
	String() string
	CrypterFound(string) (Crypter, bool)
	Options() map[string]interface{}
	Default() Crypter

	SetOptions(map[string]interface{}) Definition

	Crypt(pwd, salt []byte, options map[string]interface{}) string
}

Definition represent the public interface for a *-CRYPT

var APR1 Definition = md5driver{apr1Prefix}

APR1 is the exported driver for APR1-CRYPT

var MD5 Definition = md5driver{md5Prefix}

MD5 is the exported driver for MD5-CRYPT

type Factory

type Factory struct {
	CustomFlagHelper func([]string) string
	// contains filtered or unexported fields
}

Factory is a syntaxic sugar for finding the Definition from a password string

Example

fs := flag.NewFlagSet("", flag.ExitOnError)
fact := &Factory{
	CustomFlagHelper: func(d []string) string {
		return "type of password accepted : " + strings.Join(d, ", ")
	},
}

fact.Register(SHA256, SHA512, BCRYPT)
fs.SetOutput(os.Stdout)
fs.Var(fact, "password", fact.FlagHelper())

fs.PrintDefaults()
fs.Parse([]string{"-password=$2a$06$DCq7YPn5Rq63x1Lad4cll.TV4S6ytwfsfvkgY8jIucDrjc8deX1s."})

crypter := fact.CrypterFound()
fmt.Printf("this password is %s\n", crypter.Definition().String())

Output:

-password value
    	type of password accepted : {SHA256-CRYPT}, {SHA512-CRYPT}, {BLF-CRYPT}
this password is {BLF-CRYPT}

func (*Factory) CrypterFound

func (c *Factory) CrypterFound() Crypter

func (*Factory) FlagHelper

func (c *Factory) FlagHelper() string

func (*Factory) MarshalText

func (c *Factory) MarshalText() ([]byte, error)

MarshalText implements TextMarshaler

func (*Factory) Register

func (c *Factory) Register(def ...Definition)

func (*Factory) Set

func (c *Factory) Set(pwd string) error

Allow to use this type as a `flag.Value`

func (*Factory) SetDefault

func (c *Factory) SetDefault(def Definition)

func (*Factory) String

func (c *Factory) String() string

func (*Factory) UnmarshalText

func (c *Factory) UnmarshalText(text []byte) error

UnmarshalText implements TextUnmarshaler

Example

var t struct {
	Password *Factory `json:"pwd"`
}

data := []byte(`{"pwd":"$2a$06$DCq7YPn5Rq63x1Lad4cll.TV4S6ytwfsfvkgY8jIucDrjc8deX1s."}`)

if err := json.Unmarshal(data, &t); err != nil {
	log.Fatal(err)
}

if t.Password == nil {
	log.Fatal("no password parsed")
}

crypter := t.Password.CrypterFound()
if crypter == nil {
	log.Fatal("no password found")
}

fmt.Printf("the password in json %s is a %v\n", data, crypter.Definition())

Output:

the password in json {"pwd":"$2a$06$DCq7YPn5Rq63x1Lad4cll.TV4S6ytwfsfvkgY8jIucDrjc8deX1s."} is a {BLF-CRYPT}