How to Securely Hash Passwords in Go/App Engine: Beyond bcrypt

Secure Password Hashing in Go/App Engine

When hashing user passwords in a Go/App Engine application, it's crucial to ensure the security of the implementation. This article explores alternative methods to the bcrypt library, which faces limitations on App Engine due to its use of syscall.

Alternative Options

One recommended approach is to use the go.crypto package, which provides pure Go implementations of both bcrypt and pbkdf2. These implementations are suitable for use on App Engine.

Using bcrypt

To use bcrypt, install the package using go get and import it into your code:

<code class="go">import "golang.org/x/crypto/bcrypt"</code>

To hash a password, use the GenerateFromPassword function:

<code class="go">func Crypt(password []byte) ([]byte, error) {
    defer clear(password)
    return bcrypt.GenerateFromPassword(password, bcrypt.DefaultCost)
}</code>

Using pbkdf2

If you prefer a simpler hashing mechanism, you can use pbkdf2:

<code class="go">import "golang.org/x/crypto/pbkdf2"

func HashPassword(password, salt []byte) []byte {
    defer clear(password)
    return pbkdf2.Key(password, salt, 4096, sha256.Size, sha256.New)
}</code>

Conclusion

Both bcrypt and pbkdf2 provide secure and efficient options for password hashing in Go/App Engine applications. By using the pure Go implementations available in go.crypto, you can ensure the security and compatibility of your code.

The above is the detailed content of How to Securely Hash Passwords in Go/App Engine: Beyond bcrypt. For more information, please follow other related articles on the PHP Chinese website!