3 ms·

Just had a quick port of his example to Go. https://bitbucket.org/pkg/passwd/src/27f970fbcc05c0c6c2586000dd083f606bd0a9e2?at=master https://bitbucket.org/pkg/p

• Jabbles 13y ago
  Use bcrypt. http://godoc.org/code.google.com/p/go.crypto/bcrypt http://godoc.org/code.google.com/p/go.crypto/bcrypt
• sillysaurus3 13y ago
  1,000 rounds of PBKDF2 is less secure than just using scrypt, and probably less secure than just using bcrypt. But the code looks correct as written. It seems like a red flag that it took more than 50 lines of code to do this simple thing, though. EDIT: Specifically, should the PBKDF2 "key", not be used for something (like HMAC) rather than being used as the hash itself? Using the output of 1,000 rounds of PBKDF2 as an input to HMAC wouldn't get you any extra security.
• elithrar 13y ago
  Alternatively, Go's bcrypt implementation has a very simple API: hash, err := bcrypt.GenerateFromPassword([]byte(password), 10) err := CompareHashAndPassword(hash, []byte(password)) There's also a Cost(hash) function that you can leverage to re-hash passwords with a higher cost.