Securely Hashing and Verifying Passwords in Golang

Handling user passwords is an important aspect of web application security. In this post, we’ll explore how to securely hash and verify passwords in Golang using the bcrypt package, which provides a strong and secure implementation for password hashing.

Why use bcrypt package

“golang.org/x/crypto/bcrypt” is a Go package that provides a secure way to hash and compare passwords. It is based on the bcrypt algorithm, which is a widely-used password hashing function that is designed to be slow and computationally intensive, making it more resistant to brute-force attacks.

Here are some reasons why it is wise to use “golang.org/x/crypto/bcrypt” for password hashing:

1. Security: Bcrypt is a well-known and trusted algorithm for password hashing, and is widely used by security professionals. It has been designed to be secure and resistant to various types of attacks such as brute-force and dictionary attacks.
2. Salting: Bcrypt automatically generates and uses a salt value for each password hash, which makes it much harder for an attacker to precompute a list of hashes for common passwords. The salt value is also stored alongside the hash, so there is no need to store it separately.
3. Slow hash function: Bcrypt is intentionally slow, which makes it much harder for an attacker to perform a brute-force attack. This is because each hash calculation takes a significant amount of time, making it impractical to perform a large number of attempts in a short amount of time.
4. Easy to use: “golang.org/x/crypto/bcrypt” is a simple and easy-to-use package that provides a clear API for password hashing and comparison.
5. Cross-platform support: Bcrypt is supported across multiple platforms, so you can use it to securely hash passwords in a wide variety of applications and environments.

Overall, using “golang.org/x/crypto/bcrypt” to hash and compare passwords is a wise choice, as it provides a secure, well-tested, and easy-to-use solution that is resistant to various types of attacks.

Example Code

Below is an example of a simple Golang program that demonstrates how to hash a password and save it to a file, and later verify a provided password against the saved hash.

package main

import (
 "bufio"
 "fmt"
 "golang.org/x/crypto/bcrypt"
 "os"
 "strings"
)

const (
 passwordFile = "hashed_password.txt"
)

// saveHashedPassword saves a hashed password to a file
func saveHashedPassword(password []byte) error {
 hashedPassword, err := bcrypt.GenerateFromPassword(password, bcrypt.DefaultCost)
 if err != nil {
  return err
 }

 err = os.WriteFile(passwordFile, hashedPassword, 0644)
 if err != nil {
  return err
 }
 return nil
}

// checkPassword checks a password against a hashed password in a file
func checkPassword(password []byte) (bool, error) {
 hashedPassword, err := os.ReadFile(passwordFile)
 if err != nil {
  return false, err
 }

 err = bcrypt.CompareHashAndPassword(hashedPassword, password)
 if err != nil {
  return false, err
 }
 return true, nil
}

func main() {
 reader := bufio.NewReader(os.Stdin)
 fmt.Print("Enter a password to save: ")
 password, _ := reader.ReadString('\n')
 password = strings.TrimSpace(password)

 err := saveHashedPassword([]byte(password))
 if err != nil {
  fmt.Println("Error saving hashed password:", err)
  return
 }
 fmt.Println("Password saved successfully.")

 fmt.Print("Enter the password to check: ")
 providedPassword, _ := reader.ReadString('\n')
 providedPassword = strings.TrimSpace(providedPassword)

 isValid, err := checkPassword([]byte(providedPassword))
 if err != nil {
  fmt.Println("Error checking password:", err)
  return
 }

 if isValid {
  fmt.Println("Access granted.")
 } else {
  fmt.Println("Access denied. Invalid password.")
 }
}

Explanation

The code above demonstrates a simple Golang application that uses the bcrypt package to hash and verify passwords. It first prompts the user to enter a password, which is then hashed using bcrypt.GenerateFromPassword() and saved to a file. The user is then asked to provide a password to check, and the application verifies the provided password against the stored hash using bcrypt.CompareHashAndPassword().

Conclusion

Using the bcrypt package in Golang makes it easy to securely hash and verify passwords. The package automatically generates a unique salt for each hash, so you don't need to worry about generating or storing the salt separately. By incorporating strong password hashing into your application, you can significantly improve the security of user data and help protect against unauthorized access.

If you enjoy reading medium articles and are interested in becoming a member, I would be happy to share my referral link with you!

https://medium.com/@adamszpilewicz/membership