pinkdf2

Password-Based Key Derivation Function 2 in Gleam for Erlang as defined in RFC 2898 https://datatracker.ietf.org/doc/html/rfc2898

Types

pub type Pbkdf2Error {
  UnsupportedAlgorithm(String)
  KeyDerivedLengthTooLong
}

Constructors

  • UnsupportedAlgorithm(String)
  • KeyDerivedLengthTooLong
pub type Pbkdf2Keys {
  Pbkdf2Keys(raw: BitArray, base64: String)
}

Constructors

  • Pbkdf2Keys(raw: BitArray, base64: String)

Functions

pub fn get_salt() -> String

Generates a base64-encoded salt with a minimum size of 64 bytes. It is provided here for convenience, but it is based on the same underlying Erlang function as crypto.strong_rand_bytes.

pub fn with_config(
  alg: HashAlgorithm,
  password: String,
  salt: String,
  iterations: Int,
  d_len: Int,
) -> Result(Pbkdf2Keys, Pbkdf2Error)

Derives a key using the provided configuration.

alg may be any algorithm from crypto.HashAlgorithm except for Md5 and Sha1. ‘d_len’ is the targeted derived key length in bytes.

Examples

import gleam/crypto
import pinkdf2

let salt = pinkdf2.get_salt()
let assert Ok(key) = pinkdf2.with_config(crypto.Sha512, "password", salt, 210_000, 32)
pub fn with_defaults(
  password: String,
  salt: String,
) -> Result(Pbkdf2Keys, Pbkdf2Error)

Derives a key from a password and salt with default settings based on the (OWASP recommendations)[https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html#pbkdf2].

Search Document