Limen.Config.Keys (limen v0.2.1)

Copy Markdown View Source

Keys derived from the configured secret.

Each purpose (challenge tokens, pass cookies, socket tokens, form honeypot tokens and maze pages) gets its own key, derived with HMAC-SHA256, so a token of one kind can never be accepted as another. Each field lists the current key first, followed by keys derived from :previous_secret_keys, which are still accepted when verifying so secrets can be rotated without invalidating every pass. Maze pages are only ever seeded with the current key. Keys are kept padded and masked for HMAC-SHA256, so that computing a MAC is two one-shot hashes.

The struct never shows its contents when inspected.

Summary

Types

key()

A key prepared for HMAC-SHA256: the padded key masked for each hash.

t()

Functions

derive(secret, previous \\ [])

Derives the keys for secret and previous secrets.

Types

key()

@type key() :: {binary(), binary()}

A key prepared for HMAC-SHA256: the padded key masked for each hash.

t()

@type t() :: %Limen.Config.Keys{
  challenge: [key(), ...],
  generated: boolean(),
  maze: [key(), ...],
  pass: [key(), ...],
  socket: [key(), ...],
  trap: [key(), ...]
}

Functions

derive(secret, previous \\ [])

@spec derive(binary() | nil, [binary()]) :: t()

Derives the keys for secret and previous secrets.

Without a secret, a random one is generated: tokens then do not survive a restart and are not shared between nodes, and generated is true.