Slide 17
Slide 17 text
The Libraries
// Argon2
// Totally unnecessary, very common mistake
salt := []byte("secure salt!")
// Initial generation
// TODO: What are all these numbers?
hashed := argon2.IDKey([]byte("some password"), salt, 1,
64*1024, 4, 32)
fmt.Println(string(hashed))
// -> M���p�E'��ʿ��r��#ϷJb�x��ȕ�g (wat.jpg)
// Comparison
ohashed := argon2.IDKey([]byte("some password"), salt, 1,
64*1024, 4, 32)
// Here I should probably use a constant time comparison
// function even though the output is supposed to be a random
// oracle -- but why would I know that?
if bytes.Compare(hashed, ohashed) != 0 {
return errors.New("It doesn't match!")
}
// It's up to me to implement a scheme that saves the settings
// (all those numbers above and the salt) so that I can even
// do a comparison in the future, and that scheme won't work
// with any other Argon2 library!
return nil
// bcrypt
// Initial generation
hashed, err := bcrypt.GenerateFromPassword([]byte("some
password"), bcrypt.DefaultCost)
if err != nil {
return err
}
fmt.Println(string(hashed))
// -> $2a$10$ZwRml0Qx2TKwN2AKW3HQ1eB6dpFRe.RlUcuyG0WA91dVbCmlDbqNC
// The output includes bcrypt's settings and salt:
// $2a$ = "this is bcrypt"
// 10 = "the cost is 10" (bcrypt.DefaultCost)
// ZwRml0Qx2TKwN2AKW3HQ1eB6dpFRe = auto-generated salt
// RlUcuyG0WA91dVbCmlDbqNC = the digest
//
// This scheme is uniform across all bcrypt implementations
// Comparison
err = bcrypt.CompareHashAndPassword(hashed, []byte("some
password"))
if err != nil {
return errors.New("It doesn't match!")
}
return nil