nathanaelle/password

pure golang crypt(3) implementation

password

Implemented schemas

Safe schemas

• SHA256-CRYPT $5$ https://www.akkadia.org/drepper/sha-crypt.html
• SHA512-CRYPT $6$ https://www.akkadia.org/drepper/sha-crypt.html
• BLF-CRYPT / BCRYPT $2a$, $2$, $2x$, $2y$, $2b$

Unsafe schemas

• MD5-CRYPT $1$
• APR1 $apr1$

BLF-CRYPT apparent mess

BCrypt algorithm is secure but there was flaws in few implementations. This is the summary of the explanation of the different flavors of bcrypt :

• $2$ may be produced by a buggy version who doesn't cope with UNICODE
• $2x$ is the PHP name for buggy $2$
• $2y$ is the PHP name of $2a$
• $2b$ is the bcrypt prefix used in OpendBSD for the corrected version of $2a$ (password length was limited to 255 bytes)

License

BSD-2