pbkdf2_elixir v0.8.0 Pbkdf2 View Source
Pbkdf2 password hashing library main module.
For a lower-level API, see Pbkdf2.Base.
Link to this section Summary
Functions
Generate a random salt
Generate a random salt and hash a password using Pbkdf2
A dummy verify function to help prevent user enumeration
Verify an encoded Pbkdf2 hash
Link to this section Functions
Generate a random salt.
The default length for the salt is 16 bytes. We do not recommend using a salt shorter than the default.
Generate a random salt and hash a password using Pbkdf2.
Options
For more information about the options for the underlying hash function, see the documentation for Pbkdf2.Base.hash_password/3.
This function has the following additional option:
salt_len - the length of the random salt
- the default is 16 (the minimum is 8) bytes
- we do not recommend using a salt less than 16 bytes long
A dummy verify function to help prevent user enumeration.
This function hashes the password and then returns false, and it is intended to make it more difficult for any potential attacker to find valid usernames by using timing attacks. This function is only useful if it is used as part of a policy of hiding usernames. For more information, see the section below on username obfuscation.
It is important that this function is called with the same options that are used to hash the password.
Example
The following example looks for the user in the database and checks the
password with the stored password hash if the user is found. It then
returns the user struct, if the password is correct, or false. If no user
is found, the no_user_verify
function is called. This will take the same
time to run as the verify_hash
function. This means that the end user
will not be able to find valid usernames just by timing the responses.
def verify_password(username, password) do
case Repo.get_by(User, username: username) do
nil -> Pbkdf2.no_user_verify()
user -> Pbkdf2.verify_hash(user.password_hash, password) && user
end
end
Username obfuscation
In addition to keeping passwords secret, hiding the precise username can help make online attacks more difficult. An attacker would then have to guess a username / password combination, rather than just a password, to gain access.
This does not mean that the username should be kept completely secret. Adding a short numerical suffix to a user’s name, for example, would be sufficient to increase the attacker’s work considerably.
If you are implementing a policy of hiding usernames, it is important to make sure that the username is not revealed by any other part of your application.
Verify an encoded Pbkdf2 hash.