Data.Password.PBKDF2

Phantom type for PBKDF2

A plain-text password.

This represents a plain-text password that has NOT been hashed.

You should be careful with Password. Make sure not to write it to logs or store it in a database.

You can construct a Password by using the mkPassword function or as literal strings together with the OverloadedStrings pragma (or manually, by using fromString on a String). Alternatively, you could also use some of the instances in the password-instances library.

Construct a Password

Hash the Password using the PBKDF2 hash algorithm

>>> hashPassword $ mkPassword "foobar"PasswordHash {unPasswordHash = "sha512:25000:...:..."}

A hashed password.

This represents a password that has been put through a hashing function. The hashed password can be stored in a database.

Check a Password against a PasswordHash PBKDF2.

Returns PasswordCheckSuccess on success.

>>> let pass = mkPassword "foobar">>> passHash <- hashPassword pass>>> checkPassword pass passHashPasswordCheckSuccess

Returns PasswordCheckFail if an incorrect Password or PasswordHash PBKDF2 is used.

>>> let badpass = mkPassword "incorrect-password">>> checkPassword badpass passHashPasswordCheckFail

This should always fail if an incorrect password is given.

prop> \(Blind badpass) -> let correctPasswordHash = hashPasswordWithSalt testParams salt "foobar" in checkPassword badpass correctPasswordHash == PasswordCheckFail

The result of checking a password against a hashed version. This is returned by the checkPassword functions.

Hash a password using the PBKDF2 algorithm with the given PBKDF2Params.

N.B.: If you have any doubt in your knowledge of cryptography and/or the PBKDF2 algorithm, please just use hashPassword.

Default parameters for the PBKDF2 algorithm.

>>> defaultParamsPBKDF2Params {pbkdf2Salt = 16, pbkdf2Algorithm = PBKDF2_SHA512, pbkdf2Iterations = 25000, pbkdf2OutputLength = 64}

Extracts PBKDF2Params from a PasswordHash PBKDF2.

Returns 'Just PBKDF2Params' on success.

>>> let pass = mkPassword "foobar">>> passHash <- hashPassword pass>>> extractParams passHash == Just defaultParamsTrue

Parameters used in the PBKDF2 hashing algorithm.

Type of algorithm to use for hashing PBKDF2 passwords.

N.B.: PBKDF2_MD5 and PBKDF2_SHA1 are not considered very secure.

This is an unsafe function that shows a password in plain-text.

>>> unsafeShowPassword ("foobar" :: Password)"foobar"

You should generally not use this function in production settings, as you don't want to accidentally print a password anywhere, like logs, network responses, database entries, etc.

This will mostly be used by other libraries to handle the actual password internally, though it is conceivable that, even in a production setting, a password might have to be handled in an unsafe manner at some point.