password

README

password

Implemented schemas

Safe schemas

• SHA256-CRYPT $5$ https://www.akkadia.org/drepper/sha-crypt.html
• SHA512-CRYPT $6$ https://www.akkadia.org/drepper/sha-crypt.html
• BLF-CRYPT / BCRYPT $2a$, $2$, $2x$, $2y$, $2b$

Unsafe schemas

• MD5-CRYPT $1$
• APR1 $apr1$

BLF-CRYPT apparent mess

BCrypt algorithm is secure but there was flaws in few implementations. This is the summary of the explanation of the different flavors of bcrypt :

• $2$ may be produced by a buggy version who doesn't cope with UNICODE
• $2x$ is the PHP name for buggy $2$
• $2y$ is the PHP name of $2a$
• $2b$ is the bcrypt prefix used in OpendBSD for the corrected version of $2a$ (password length was limited to 255 bytes)

License

BSD-2

Documentation

Index

• Variables
• func Register(def ...Definition)
• func Set(pwd string) error
• func SetDefault(def Definition)
• type Crypter
  • func CrypterFound() Crypter
• type Definition
• type Factory
  • func (c *Factory) CrypterFound() Crypter
  • func (c *Factory) FlagHelper() string
  • func (p *Factory) MarshalText() ([]byte, error)
  • func (c *Factory) Register(def ...Definition)
  • func (c *Factory) Set(pwd string) error
  • func (c *Factory) SetDefault(def Definition)
  • func (c *Factory) String() string
  • func (p *Factory) UnmarshalText(text []byte) error

Examples

• Factory
• Factory.UnmarshalText

Variables

var (
	NoMatchingDef       error = errors.New("No Matching Definition Found")
	ERR_NOPE            error = errors.New("NOPE")
	ErrUnknownMD5Prefix error = errors.New("Unknown MD5-CRYPT Prefix")
)

Functions

func Register

func Register(def ...Definition)

register the definition of a new crypter

func Set

func Set(pwd string) error

see `Crypt.Set(string) error`

func SetDefault

func SetDefault(def Definition)

define a default crypter

Types

type Crypter

type Crypter interface {
	Salt(salt []byte) Crypter
	Hashed(pwd []byte) Crypter
	Crypt(pwd []byte) Crypter
	Verify(pwd []byte) bool
	Options() map[string]interface{}
	Definition() Definition
	encoding.TextMarshaler
	flag.Value
}

func CrypterFound

func CrypterFound() Crypter

type Definition

type Definition interface {
	String() string
	CrypterFound(string) (Crypter, bool)
	Options() map[string]interface{}
	Default() Crypter

	SetOptions(map[string]interface{}) Definition

	Crypt(pwd, salt []byte, options map[string]interface{}) string
}

var APR1 Definition = md5driver{apr1_prefix}

var BCRYPT Definition = register(bcryptdriver{bcrypt_prefix[0], bcrypt_def_cost})

var MD5 Definition = md5driver{md5_prefix}

var SHA256 Definition = register(sha256driver{sha256_def_rounds})

var SHA512 Definition = register(sha512driver{sha512_def_rounds})

type Factory

type Factory struct {
	CustomFlagHelper func([]string) string
	// contains filtered or unexported fields
}

Example

fs := flag.NewFlagSet("", flag.ExitOnError)
fact := &Factory{
	CustomFlagHelper: func(d []string) string {
		return "type of password accepted : " + strings.Join(d, ", ")
	},
}

fact.Register(SHA256, SHA512, BCRYPT)
fs.SetOutput(os.Stdout)
fs.Var(fact, "password", fact.FlagHelper())

fs.PrintDefaults()
fs.Parse([]string{"-password=$2a$06$DCq7YPn5Rq63x1Lad4cll.TV4S6ytwfsfvkgY8jIucDrjc8deX1s."})

crypter := fact.CrypterFound()
fmt.Printf("this password is %s\n", crypter.Definition().String())

Output:

-password value
    	type of password accepted : {SHA256-CRYPT}, {SHA512-CRYPT}, {BLF-CRYPT}
this password is {BLF-CRYPT}

func (*Factory) CrypterFound

func (c *Factory) CrypterFound() Crypter

func (*Factory) FlagHelper

func (c *Factory) FlagHelper() string

func (*Factory) MarshalText

func (p *Factory) MarshalText() ([]byte, error)

func (*Factory) Register

func (c *Factory) Register(def ...Definition)

func (*Factory) Set

func (c *Factory) Set(pwd string) error

Allow to use this type as a `flag.Value`

func (*Factory) SetDefault

func (c *Factory) SetDefault(def Definition)

func (*Factory) String

func (c *Factory) String() string

func (*Factory) UnmarshalText

func (p *Factory) UnmarshalText(text []byte) error

Example

var t struct {
	Password *Factory `json:"pwd"`
}

data := []byte(`{"pwd":"$2a$06$DCq7YPn5Rq63x1Lad4cll.TV4S6ytwfsfvkgY8jIucDrjc8deX1s."}`)

if err := json.Unmarshal(data, &t); err != nil {
	log.Fatal(err)
}

if t.Password == nil {
	log.Fatal("no password parsed")
}

crypter := t.Password.CrypterFound()
if crypter == nil {
	log.Fatal("no password found")
}

fmt.Printf("the password in json %s is a %v\n", data, crypter.Definition())

Output:

the password in json {"pwd":"$2a$06$DCq7YPn5Rq63x1Lad4cll.TV4S6ytwfsfvkgY8jIucDrjc8deX1s."} is a {BLF-CRYPT}