Documentation
¶
Overview ¶
Package crypto provides cryptographic utilities for secure applications. It includes Argon2id password hashing, secure random token generation, and RSA/ECDSA key generation helpers.
Index ¶
- Constants
- func BcryptCost(hash string) (int, error)
- func ECDSAPrivateKeyToPEM(key *ecdsa.PrivateKey) ([]byte, error)
- func ECDSAPublicKeyToPEM(key *ecdsa.PublicKey) ([]byte, error)
- func GenerateECDSAKeyPair(curve elliptic.Curve) (*ecdsa.PrivateKey, *ecdsa.PublicKey, error)
- func GenerateRSAKeyPair(bits int) (*rsa.PrivateKey, *rsa.PublicKey, error)
- func GenerateToken(length int) (string, error)
- func HashPassword(password string) (string, error)
- func HashPasswordBcrypt(password string, cost int) (string, error)
- func HashPasswordWithConfig(password string, cfg PasswordConfig) (string, error)
- func MustGenerateToken(length int) string
- func ParseECDSAPrivateKeyPEM(data []byte) (*ecdsa.PrivateKey, error)
- func ParseECDSAPublicKeyPEM(data []byte) (*ecdsa.PublicKey, error)
- func ParseRSAPrivateKeyPEM(data []byte) (*rsa.PrivateKey, error)
- func ParseRSAPublicKeyPEM(data []byte) (*rsa.PublicKey, error)
- func RSAPrivateKeyToPEM(key *rsa.PrivateKey) ([]byte, error)
- func RSAPublicKeyToPEM(key *rsa.PublicKey) ([]byte, error)
- func VerifyPassword(password, encoded string) (bool, error)
- func VerifyPasswordBcrypt(password, hash string) (bool, error)
- type PasswordConfig
Constants ¶
const DefaultBcryptCost = bcrypt.DefaultCost
DefaultBcryptCost is the default bcrypt work factor (10). Increase for higher security at the cost of more CPU time per hash. Benchmark on your hardware: a hash should take roughly 100–300 ms.
Variables ¶
This section is empty.
Functions ¶
func BcryptCost ¶
BcryptCost returns the cost factor embedded in an existing bcrypt hash. Useful when deciding whether to rehash a stored hash at a higher cost.
func ECDSAPrivateKeyToPEM ¶
func ECDSAPrivateKeyToPEM(key *ecdsa.PrivateKey) ([]byte, error)
ECDSAPrivateKeyToPEM encodes an ECDSA private key to PKCS8 PEM format.
func ECDSAPublicKeyToPEM ¶
ECDSAPublicKeyToPEM encodes an ECDSA public key to PKIX PEM format.
func GenerateECDSAKeyPair ¶
GenerateECDSAKeyPair generates an ECDSA key pair using the given curve. Recommended: elliptic.P256() (ES256) or elliptic.P521() (ES512).
func GenerateRSAKeyPair ¶
GenerateRSAKeyPair generates an RSA key pair of the given bit size. Use 2048 as the minimum; prefer 4096 for long-lived keys.
func GenerateToken ¶
GenerateToken returns a cryptographically secure random token of the given byte length, encoded as a base64url string (no padding). A length of 32 bytes provides 256 bits of entropy — suitable for session tokens, CSRF tokens, and API keys.
func HashPassword ¶
HashPassword hashes a plaintext password using Argon2id with the default configuration. The returned string is PHC-formatted and safe to store directly in a database.
func HashPasswordBcrypt ¶
HashPasswordBcrypt hashes password using bcrypt with the given cost factor. Pass 0 to use DefaultBcryptCost.
Prefer HashPassword (Argon2id) for new systems — bcrypt is provided for compatibility with existing databases that already store bcrypt hashes.
func HashPasswordWithConfig ¶
func HashPasswordWithConfig(password string, cfg PasswordConfig) (string, error)
HashPasswordWithConfig hashes a password using the given Argon2id configuration.
func MustGenerateToken ¶
MustGenerateToken is like GenerateToken but panics on error. Only use in initialization code or tests where panicking is acceptable.
func ParseECDSAPrivateKeyPEM ¶
func ParseECDSAPrivateKeyPEM(data []byte) (*ecdsa.PrivateKey, error)
ParseECDSAPrivateKeyPEM parses a PEM-encoded PKCS8 ECDSA private key.
func ParseECDSAPublicKeyPEM ¶
ParseECDSAPublicKeyPEM parses a PEM-encoded PKIX ECDSA public key.
func ParseRSAPrivateKeyPEM ¶
func ParseRSAPrivateKeyPEM(data []byte) (*rsa.PrivateKey, error)
ParseRSAPrivateKeyPEM parses a PEM-encoded PKCS8 RSA private key.
func ParseRSAPublicKeyPEM ¶
ParseRSAPublicKeyPEM parses a PEM-encoded PKIX RSA public key.
func RSAPrivateKeyToPEM ¶
func RSAPrivateKeyToPEM(key *rsa.PrivateKey) ([]byte, error)
RSAPrivateKeyToPEM encodes an RSA private key to PKCS8 PEM format.
func RSAPublicKeyToPEM ¶
RSAPublicKeyToPEM encodes an RSA public key to PKIX PEM format.
func VerifyPassword ¶
VerifyPassword checks whether password matches the encoded Argon2id hash. Uses constant-time comparison to prevent timing attacks.
func VerifyPasswordBcrypt ¶
VerifyPasswordBcrypt checks whether password matches the stored bcrypt hash. Returns (false, nil) on mismatch — only returns an error on unexpected failure.
Types ¶
type PasswordConfig ¶
type PasswordConfig struct {
Memory uint32 // KiB of memory (default: 64 MiB)
Iterations uint32 // Number of passes (default: 3)
Parallelism uint8 // Degree of parallelism (default: 2)
SaltLength uint32 // Salt length in bytes (default: 16)
KeyLength uint32 // Derived key length in bytes (default: 32)
}
PasswordConfig holds the Argon2id tuning parameters.
func DefaultPasswordConfig ¶
func DefaultPasswordConfig() PasswordConfig
DefaultPasswordConfig returns OWASP-recommended Argon2id parameters.
Source Files