v0.2.0 restructured and generalized to be more modular, added golang-jwt dependency

argon2.go

@@ -13,40 +13,85 @@ import (
 
 // Default Argon2id parameters
 const (
-	DefaultArgonTime    = 3         // iterations (reduce for faster but less secure auth)
+	DefaultArgonTime    = 3         // iterations
 	DefaultArgonMemory  = 64 * 1024 // 64 MB
 	DefaultArgonThreads = 4
 	DefaultArgonSaltLen = 16
 	DefaultArgonKeyLen  = 32
 )
 
-// HashPassword creates an Argon2id PHC-format hash
-func (a *Authenticator) HashPassword(password string) (string, error) {
+// argonParams holds configurable Argon2id parameters
+type argonParams struct {
+	time    uint32
+	memory  uint32
+	threads uint8
+	keyLen  uint32
+	saltLen uint32
+}
+
+// Option configures Argon2id hashing parameters
+type Option func(*argonParams)
+
+// WithTime sets Argon2 iterations
+func WithTime(t uint32) Option {
+	return func(p *argonParams) {
+		if t > 0 {
+			p.time = t
+		}
+	}
+}
+
+// WithMemory sets Argon2 memory in KiB
+func WithMemory(m uint32) Option {
+	return func(p *argonParams) {
+		if m > 0 {
+			p.memory = m
+		}
+	}
+}
+
+// WithThreads sets Argon2 parallelism
+func WithThreads(t uint8) Option {
+	return func(p *argonParams) {
+		if t > 0 {
+			p.threads = t
+		}
+	}
+}
+
+// HashPassword creates Argon2id PHC-format hash (standalone)
+func HashPassword(password string, opts ...Option) (string, error) {
 	if len(password) < 8 {
 		return "", ErrWeakPassword
 	}
 
-	// Generate salt
-	salt := make([]byte, DefaultArgonSaltLen)
+	params := &argonParams{
+		time:    DefaultArgonTime,
+		memory:  DefaultArgonMemory,
+		threads: DefaultArgonThreads,
+		keyLen:  DefaultArgonKeyLen,
+		saltLen: DefaultArgonSaltLen,
+	}
+
+	for _, opt := range opts {
+		opt(params)
+	}
+
+	salt := make([]byte, params.saltLen)
 	if _, err := rand.Read(salt); err != nil {
 		return "", fmt.Errorf("%w: %v", ErrSaltGenerationFailed, err)
 	}
 
-	// Derive key using Argon2id
-	hash := argon2.IDKey([]byte(password), salt, a.argonTime, a.argonMemory, a.argonThreads, DefaultArgonKeyLen)
+	hash := argon2.IDKey([]byte(password), salt, params.time, params.memory, params.threads, params.keyLen)
 
-	// Construct PHC format
 	saltB64 := base64.RawStdEncoding.EncodeToString(salt)
 	hashB64 := base64.RawStdEncoding.EncodeToString(hash)
-	phcHash := fmt.Sprintf("$argon2id$v=%d$m=%d,t=%d,p=%d$%s$%s",
-		argon2.Version, a.argonMemory, a.argonTime, a.argonThreads, saltB64, hashB64)
-
-	return phcHash, nil
+	return fmt.Sprintf("$argon2id$v=%d$m=%d,t=%d,p=%d$%s$%s",
+		argon2.Version, params.memory, params.time, params.threads, saltB64, hashB64), nil
 }
 
-// VerifyPassword checks password against PHC-format hash
-func (a *Authenticator) VerifyPassword(password, phcHash string) error {
-	// Parse PHC format
+// VerifyPassword checks password against PHC-format hash (standalone)
+func VerifyPassword(password, phcHash string) error {
 	parts := strings.Split(phcHash, "$")
 	if len(parts) != 6 || parts[1] != "argon2id" {
 		return ErrPHCInvalidFormat
@@ -66,10 +111,8 @@ func (a *Authenticator) VerifyPassword(password, phcHash string) error {
 		return fmt.Errorf("%w: %v", ErrPHCInvalidHash, err)
 	}
 
-	// Compute hash with same parameters
 	computedHash := argon2.IDKey([]byte(password), salt, time, memory, threads, uint32(len(expectedHash)))
 
-	// Constant-time comparison
 	if subtle.ConstantTimeCompare(computedHash, expectedHash) != 1 {
 		return ErrInvalidCredentials
 	}
@@ -77,9 +120,8 @@ func (a *Authenticator) VerifyPassword(password, phcHash string) error {
 	return nil
 }
 
-// MigrateFromPHC converts existing Argon2 PHC hash to SCRAM credential
+// MigrateFromPHC converts PHC hash to SCRAM credential
 func MigrateFromPHC(username, password, phcHash string) (*Credential, error) {
-	// Parse PHC format
 	parts := strings.Split(phcHash, "$")
 	if len(parts) != 6 || parts[1] != "argon2id" {
 		return nil, ErrPHCInvalidFormat
@@ -94,17 +136,10 @@ func MigrateFromPHC(username, password, phcHash string) (*Credential, error) {
 		return nil, ErrPHCInvalidSalt
 	}
 
-	expectedHash, err := base64.RawStdEncoding.DecodeString(parts[5])
-	if err != nil {
-		return nil, ErrPHCInvalidHash
+	// Use standalone function for verification
+	if err := VerifyPassword(password, phcHash); err != nil {
+		return nil, err
 	}
 
-	// Verify password against hash
-	computedHash := argon2.IDKey([]byte(password), salt, time, memory, threads, uint32(len(expectedHash)))
-	if subtle.ConstantTimeCompare(computedHash, expectedHash) != 1 {
-		return nil, ErrInvalidCredentials
-	}
-
-	// Derive SCRAM credential with same parameters
 	return DeriveCredential(username, password, salt, time, memory, threads)
 }