gehirninc / crypt

Pure Go crypt(3) Implementation

crypt - A password hashing library for Go

crypt provides pure golang implementations of UNIX's crypt(3).

The goal of crypt is to bring a library of many common and popular password hashing algorithms to Go and to provide a simple and consistent interface to each of them. As every hashing method is implemented in pure Go, this library should be as portable as Go itself.

All hashing methods come with a test suite which verifies their operation against itself as well as the output of other password hashing implementations to ensure compatibility with them.

I hope you find this library to be useful and easy to use!

Install

To install crypt, use the go get command.

go get github.com/GehirnInc/crypt

Usage

package main

import (
    "fmt"

    "github.com/GehirnInc/crypt"
    _ "github.com/GehirnInc/crypt/sha256_crypt"
)

func main() {
    crypt := crypt.SHA256.New()
    ret, _ := crypt.Generate([]byte("secret"), []byte("$5$salt"))
    fmt.Println(ret)

    err := crypt.Verify(ret, []byte("secret"))
    fmt.Println(err)

    // Output:
    // $5$salt$kpa26zwgX83BPSR8d7w93OIXbFt/d3UOTZaAu5vsTM6
    // <nil>
}

Documentation

The documentation is available on GoDoc.

crypt's Issues

NewFromHash() function failed with panic

package main

import (
    "github.com/GehirnInc/crypt"
    _ "github.com/GehirnInc/crypt/sha256_crypt"
)

func main() {
    crypt.NewFromHash("$5$zt1EpbKWbqit0l8h")
}

Output:

panic: crypt: requested crypt function is unavailable

yescrypt support?

Thanks for your contribution, now some Linux distributions (such as debian 11) use yescrypt as the default encryption by default.

Is there any plan for yescrypt method?

Thanks

Add a tag for new version

git tag v1.0.0
git push origin v1.0.0

Missing DES implementation

Thanks for writing this package. It seems to be missing the DES implementation?

crypt() is the password encryption function.  It is based on the Data Encryption Standard algorithm with variations intended (among other things) to discourage use of hardware implementations of a key search.

If a salt didn't have $id$ in it, it should end up doing the basic crypt that results in a hash of length 13.

proposal: move to x/crypto

Hi, there's a discussion here about crypt(3) support in x/crypto.

Is anyone interested in migrating this repository? I think it does make sense to be part of x/crypto.

Bug in Verify code when rounds is specified

When using https://pkg.go.dev/bytes#SplitN as part of the Decode step for Verify call, the $<id>[$<param>=<value>(,<param>=<value>)*][$<salt>[$<hash>]] formatted string is not properly split, leading into incorrect results for Verify
See: https://play.golang.org/p/Pk8URcLJxmx

For a hash string like this, the results in a tokens array that has incorrectly combined the hash with the salt. $6$rounds=10000$mysalt$9XTP7570fxVN/uTspSrH6kRPdR4KKGzGz7.TmJjDYGrKSwZuavW/3YaLur8JX6WP75Czcxa.megIO0lKreY0R.
Thus, call at https://github.com/GehirnInc/crypt/blob/master/common/salt.go#L125 incorrectly parses the salt, leading to error in the Verification.