Comeonin.Pbkdf2

Module to handle pbkdf2_sha512 authentication.

Pbkdf2 is a password-based key derivation function that uses a password, a variable-length salt and an iteration count and applies a pseudorandom function to these to produce a key.

The original implementation used SHA-1 as the pseudorandom function, but this version uses HMAC-SHA-512.

Summary

Functions

Check the password

Perform a dummy check for a user that does not exist. This always returns false. The reason for implementing this check is in order to make user enumeration by timing responses more difficult

Generate a salt for use with the hashpass function

Hash the password using pbkdf2_sha512

Hash the password with a salt which is randomly generated

Functions

checkpw(password, hash)

Check the password.

The check is performed in constant time to avoid timing attacks.

dummy_checkpw()

Perform a dummy check for a user that does not exist. This always returns false. The reason for implementing this check is in order to make user enumeration by timing responses more difficult.

gen_salt(salt_length \\ 16)

Generate a salt for use with the hashpass function.

The minimum length of the salt is 16 and the maximum length is 1024. The default is 16.

hashpass(password, salt, rounds \\ Config.pbkdf2_rounds())

Hash the password using pbkdf2_sha512.

hashpwsalt(password)

Hash the password with a salt which is randomly generated.

To change the complexity (and the time taken) of the password hash calculation, you need to change the value for pbkdf2_rounds in the config file.