73 lines
2.3 KiB
Rust
73 lines
2.3 KiB
Rust
//! Argon2 password hashing utilities.
|
|
//!
|
|
//! This module provides secure password hashing and verification using the Argon2 algorithm.
|
|
//! The hashing parameters are configured for a balance between security and performance.
|
|
|
|
use argon2::{
|
|
password_hash::{
|
|
rand_core::OsRng, Error, PasswordHash, PasswordHasher, PasswordVerifier,
|
|
SaltString,
|
|
},
|
|
Argon2,
|
|
};
|
|
|
|
/// Hash a password using Argon2id algorithm.
|
|
///
|
|
/// This function generates a cryptographically secure salt and hashes the password
|
|
/// with predefined parameters optimized for a balance of security and performance.
|
|
///
|
|
/// # Arguments
|
|
/// * `password` - The plain text password to hash
|
|
///
|
|
/// # Returns
|
|
/// * `Ok(String)` - The hashed password in PHC string format
|
|
/// * `Err(Error)` - If hashing fails
|
|
///
|
|
/// # Example
|
|
/// ```
|
|
/// use imphnen_libs::hash_password;
|
|
///
|
|
/// let hash = hash_password("my_password")?;
|
|
/// assert!(hash.starts_with("$argon2id$"));
|
|
/// # Ok::<(), argon2::password_hash::Error>(())
|
|
/// ```
|
|
pub fn hash_password(password: &str) -> Result<String, Error> {
|
|
let salt = SaltString::generate(&mut OsRng);
|
|
let argon2 = Argon2::default();
|
|
let password_hash = argon2
|
|
.hash_password(password.as_bytes(), &salt)?
|
|
.to_string();
|
|
Ok(password_hash)
|
|
}
|
|
|
|
/// Verify a password against its hash.
|
|
///
|
|
/// This function checks if the provided password matches the given hash.
|
|
/// Returns false for both incorrect passwords and invalid hash formats.
|
|
///
|
|
/// # Arguments
|
|
/// * `password` - The plain text password to verify
|
|
/// * `hash` - The hashed password in PHC string format
|
|
///
|
|
/// # Returns
|
|
/// * `Ok(bool)` - true if password matches, false otherwise
|
|
/// * `Err(Error)` - If hash parsing fails
|
|
///
|
|
/// # Example
|
|
/// ```
|
|
/// use imphnen_libs::{hash_password, verify_password};
|
|
///
|
|
/// let hash = hash_password("my_password")?;
|
|
/// assert!(verify_password("my_password", &hash)?);
|
|
/// assert!(!verify_password("wrong_password", &hash)?);
|
|
/// # Ok::<(), argon2::password_hash::Error>(())
|
|
/// ```
|
|
pub fn verify_password(password: &str, hash: &str) -> Result<bool, Error> {
|
|
let parsed_hash = PasswordHash::new(hash)?;
|
|
let argon2 = Argon2::default();
|
|
match argon2.verify_password(password.as_bytes(), &parsed_hash) {
|
|
Ok(_) => Ok(true),
|
|
Err(_) => Ok(false),
|
|
}
|
|
}
|