forked from cockroachdb/cockroach
/
password.go
86 lines (75 loc) · 2.47 KB
/
password.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
// Copyright 2015 The Cockroach Authors.
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
// implied. See the License for the specific language governing
// permissions and limitations under the License.
//
// Author: Marc Berhault (marc@cockroachlabs.com)
package security
import (
"bytes"
"crypto/sha256"
"fmt"
"syscall"
"github.com/pkg/errors"
"golang.org/x/crypto/bcrypt"
"golang.org/x/crypto/ssh/terminal"
)
// BCrypt cost should increase along with computation power.
// For estimates, see: http://security.stackexchange.com/questions/17207/recommended-of-rounds-for-bcrypt
// For now, we use the library's default cost.
const bcryptCost = bcrypt.DefaultCost
// ErrEmptyPassword indicates that an empty password was attempted to be set.
var ErrEmptyPassword = errors.New("empty passwords are not permitted")
func compareHashAndPassword(hashedPassword []byte, password string) error {
h := sha256.New()
return bcrypt.CompareHashAndPassword(hashedPassword, h.Sum([]byte(password)))
}
// HashPassword takes a raw password and returns a bcrypt hashed password.
func HashPassword(password string) ([]byte, error) {
h := sha256.New()
return bcrypt.GenerateFromPassword(h.Sum([]byte(password)), bcryptCost)
}
// PromptForPassword prompts for a password twice, returning the read string if
// they match, or an error.
func PromptForPassword() (string, error) {
fmt.Print("Enter password: ")
one, err := terminal.ReadPassword(syscall.Stdin)
if err != nil {
return "", err
}
if len(one) == 0 {
return "", ErrEmptyPassword
}
fmt.Print("\nConfirm password: ")
two, err := terminal.ReadPassword(syscall.Stdin)
if err != nil {
return "", err
}
// Make sure stdout moves on to the next line.
fmt.Print("\n")
if !bytes.Equal(one, two) {
return "", errors.New("password mismatch")
}
return string(one), nil
}
// PromptForPasswordAndHash prompts for a password twice and returns the bcrypt
// hash.
func PromptForPasswordAndHash() ([]byte, error) {
password, err := PromptForPassword()
if err != nil {
return nil, err
}
if password == "" {
return nil, nil
}
return HashPassword(password)
}