Skip to content

Commit

Permalink
update readme
Browse files Browse the repository at this point in the history
  • Loading branch information
dwin committed Oct 20, 2017
1 parent 6cf81be commit 6309053
Showing 1 changed file with 1 addition and 0 deletions.
1 change: 1 addition & 0 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,7 @@

[![Go Report Card](https://goreportcard.com/badge/github.com/dwin/goSecretBoxPassword)](https://goreportcard.com/report/github.com/dwin/goSecretBoxPassword) [![GoDoc](https://godoc.org/github.com/dwin/goSecretBoxPassword?status.svg)](https://godoc.org/github.com/dwin/goSecretBoxPassword)
[![cover.run go](https://cover.run/go/github.com/dwin/goSecretBoxPassword.svg)](https://cover.run/go/github.com/dwin/goSecretBoxPassword)
[![Build Status](https://travis-ci.org/dwin/goSecretBoxPassword.svg?branch=master)](https://travis-ci.org/dwin/goSecretBoxPassword)

This is a Golang library for securing passwords it is based on the [Dropbox method for password storage](https://blogs.dropbox.com/tech/2016/09/how-dropbox-securely-stores-your-passwords/). The both passphrases are first hashed with [Blake2b-512](https://godoc.org/golang.org/x/crypto/blake2b) then a random 64-bit salt is generated and a secure hash is generated using [Scrypt](https://godoc.org/golang.org/x/crypto/scrypt) with the user specified parameters. The salt is appended to resulting 56 byte hash for a total of 64 bytes. The masterpassphrase Scrypt output, which Dropbox describes as a global pepper, is then hashed with Blake2b-256 and is used as a key along with a 192-bit random nonce value for the user passphrase Scrypt output along with Scrypt salt to be encrypted using [NaCl Secretbox](https://godoc.org/golang.org/x/crypto/nacl/secretbox). NaCl Secretbox uses XSalsa20 and Poly1305 to encrypt and authenticate data.

Expand Down

0 comments on commit 6309053

Please sign in to comment.