pbkdf2_elixir v0.12.2 Pbkdf2 View Source

Pbkdf2 password hashing library main module.

For a lower-level API, see Pbkdf2.Base.

Pbkdf2

Pbkdf2 is a password-based key derivation function that uses a password, a variable-length salt and an iteration count and applies a pseudorandom function to these to produce a key.

The original implementation used SHA-1 as the pseudorandom function, but this version uses HMAC-SHA-512, the default, or HMAC-SHA-256.

Link to this section Summary

Functions

Generate a random salt

Generate a random salt and hash a password using Pbkdf2

A dummy verify function to help prevent user enumeration

Check the password by comparing it with the stored hash

Link to this section Functions

Link to this function gen_salt(salt_length \\ 16) View Source

Generate a random salt.

The minimum length of the salt is 8 bytes and the maximum length is

  1. The default length for the salt is 16 bytes. We do not recommend using a salt shorter than the default.
Link to this function hash_pwd_salt(password, opts \\ []) View Source

Generate a random salt and hash a password using Pbkdf2.

Options

For more information about the options for the underlying hash function, see the documentation for Pbkdf2.Base.hash_password/3.

This function has the following additional option:

  • salt_len - the length of the random salt

    • the default is 16 (the minimum is 8) bytes
    • we do not recommend using a salt less than 16 bytes long
Link to this function no_user_verify(opts \\ []) View Source

A dummy verify function to help prevent user enumeration.

This always returns false. The reason for implementing this check is in order to make it more difficult for an attacker to identify users by timing responses.

Link to this function verify_pass(password, stored_hash) View Source

Check the password by comparing it with the stored hash.

The check is performed in constant time to avoid timing attacks.