Goで安全にパスワードをハッシュ化する

1type Argon2idHash struct {
2	// time represents the number of 
3	// passed over the specified memory.
4	time    uint32
5	// cpu memory to be used.
6	memory  uint32
7	// threads for parallelism aspect
8	// of the algorithm.
9	threads uint8
10	// keyLen of the generate hash key.
11	keyLen  uint32
12	// saltLen the length of the salt used.
13	saltLen uint32
14}

1// NewArgon2idHash constructor function for 
2// Argon2idHash.
3func NewArgon2idHash(time, saltLen uint32, memory uint32, threads uint8, keyLen uint32) *Argon2idHash {
4	return &Argon2idHash{
5		time:    time,
6		saltLen: saltLen,
7		memory:  memory,
8		threads: threads,
9		keyLen:  keyLen,
10	}
11}

1func randomSecret(length uint32) ([]byte, error) {
2	secret := make([]byte, length)
3
4	_, err := rand.Read(secret)
5	if err != nil {
6		return nil, err
7	}
8
9	return secret, nil
10}

1// GenerateHash using the password and provided salt.
2// If not salt value provided fallback to random value
3// generated of a given length.
4func (a *Argon2idHash) GenerateHash(password, salt []byte) (*HashSalt, error) {
5	var err error
6	// If salt is not provided generate a salt of
7	// the configured salt length.
8	if len(salt) == 0 {
9		salt, err = randomSecret(a.saltLen)
10	}
11	if err != nil {
12		return nil, err
13	}
14	// Generate hash
15	hash := argon2.IDKey(password, salt, a.time, a.memory, a.threads, a.keyLen)
16	// Return the generated hash and salt used for storage.
17	return &HashSalt{Hash: hash, Salt: salt}, nil
18}

1// Compare generated hash with store hash.
2func (a *Argon2idHash) Compare(hash, salt, password []byte) error {
3	// Generate hash for comparison.
4	hashSalt, err := a.GenerateHash(password, salt)
5	if err != nil {
6		return err
7	}
8	// Compare the generated hash with the stored hash.
9	// If they don't match return error.
10	if !bytes.Equal(hash, hashSalt.Hash) {
11		return errors.New("hash doesn't match")
12	}
13	return nil
14}

1func Key(password, salt []byte, iter, keyLen int, h func() hash.Hash) []byte

1// PBKDF2Hash used to generate hash
2// from plain text password and also
3// compare plain text password with
4// stored hash.
5type PBKDF2Hash struct {
6	// itr the number of iterations.
7	itr int
8	// keyLen the length of the generated key.
9	keyLen int
10	// saltLen the length of the salt used.
11	saltLen int
12}

1// GenerateHash using the password and provided salt.
2// If not salt value provided fallback to random value
3// generated of a given length.
4func (p *PBKDF2Hash) GenerateHash(password, salt []byte) (*HashSalt, error) {
5	var err error
6	// If salt is not provided generate a salt of
7	// the configured salt length.
8	if len(salt) == 0 {
9		salt, err = randomSecret(p.saltLen)
10	}
11	if err != nil {
12		return nil, err
13	}
14	// Generate hash using pbkdf2 exported key method.
15	hash := pbkdf2.Key(password, salt, p.itr, p.keyLen, sha3.New256)
16	// Return the generated hash and salt used for storage.
17	return &HashSalt{Hash: hash, Salt: salt}, nil
18}

1// Compare generated hash with store hash.
2func (p *PBKDF2Hash) Compare(hash, salt, password []byte) error {
3	// Generate hash for comparison.
4	hashSalt, err := p.GenerateHash(password, salt)
5	if err != nil {
6		return err
7	}
8	// Compare the generated hash with the stored hash.
9	// If they don't match return error.
10	if !bytes.Equal(hash, hashSalt.Hash) {
11		return errors.New("hash doesn't match")
12	}
13	return nil
14}

1package main
2
3import (
4	"bytes"
5	"context"
6	"errors"
7
8	"golang.org/x/crypto/argon2"
9)
10
11// HashSalt struct used to store
12// generated hash and salt used to
13// generate the hash.
14type HashSalt struct {
15	Hash, Salt []byte
16}
17
18type Argon2idHash struct {
19	// time represents the number of 
20	// passed over the specified memory.
21	time    uint32
22	// cpu memory to be used.
23	memory  uint32
24	// threads for parallelism aspect
25	// of the algorithm.
26	threads uint8
27	// keyLen of the generate hash key.
28	keyLen  uint32
29	// saltLen the length of the salt used.
30	saltLen uint32
31}
32
33// NewArgon2idHash constructor function for 
34// Argon2idHash.
35func NewArgon2idHash(time, saltLen uint32, memory uint32, threads uint8, keyLen uint32) *Argon2idHash {
36	return &Argon2idHash{
37		time:    time,
38		saltLen: saltLen,
39		memory:  memory,
40		threads: threads,
41		keyLen:  keyLen,
42	}
43}
44
45// GenerateHash using the password and provided salt.
46// If not salt value provided fallback to random value
47// generated of a given length.
48func (a *Argon2idHash) GenerateHash(password, salt []byte) (*HashSalt, error) {
49	var err error
50	// If salt is not provided generate a salt of
51	// the configured salt length.
52	if len(salt) == 0 {
53		salt, err = randomSecret(a.saltLen)
54	}
55	if err != nil {
56		return nil, err
57	}
58	// Generate hash
59	hash := argon2.IDKey(password, salt, a.time, a.memory, a.threads, a.keyLen)
60	// Return the generated hash and salt used for storage.
61	return &HashSalt{Hash: hash, Salt: salt}, nil
62}
63
64// Compare generated hash with store hash.
65func (a *Argon2idHash) Compare(hash, salt, password []byte) error {
66	// Generate hash for comparison.
67	hashSalt, err := a.GenerateHash(password, salt)
68	if err != nil {
69		return err
70	}
71	// Compare the generated hash with the stored hash.
72	// If they don't match return error.
73	if !bytes.Equal(hash, hashSalt.Hash) {
74		return errors.New("hash doesn't match")
75	}
76	return nil
77}

1package main
2
3import (
4	"context"
5	"crypto/rand"
6
7	"fmt"
8	"os"
9)
10
11func main() {
12	password := []byte("super-secret-password")
13
14	argon2IDHash := NewArgon2idHash(1, 32, 64*1024, 32, 256)
15
16	hashSalt, err := argon2IDHash.GenerateHash(password, nil)
17	if err != nil {
18		fmt.Fprintln(os.Stderr, err)
19		os.Exit(1)
20	}
21
22	fmt.Println(hashSalt.Hash)
23	fmt.Println(hashSalt.Salt)
24
25	err = argon2IDHash.Compare(hashSalt.Hash, hashSalt.Salt, password)
26	if err != nil {
27		fmt.Fprintln(os.Stderr, err)
28		os.Exit(1)
29	}
30	fmt.Println("argon2IDHash Password and Hash match")
31}
32
33func randomSecret(length uint32) ([]byte, error) {
34	secret := make([]byte, length)
35
36	_, err := rand.Read(secret)
37	if err != nil {
38		return nil, err
39	}
40
41	return secret, nil
42}