passwordhasher.h

Go to the documentation of this file.

#ifndef PASSWORDHASHER_H
#define PASSWORDHASHER_H
 
#include <QByteArray>
#include <QObject>
#include <QString>
 
// scrypt cost parameters used for newly created password verifiers. These match
// the RFC 7914 recommended parameters for interactive use.
constexpr int SCRYPT_N = 32768;
constexpr int SCRYPT_R = 8;
constexpr int SCRYPT_P = 1;
constexpr int SCRYPT_SALT_LENGTH = 16;
constexpr int SCRYPT_VERIFIER_LENGTH = 64;
 
enum class PasswordFormat
{
    None = 0,
    Scrypt
};
 
struct PasswordVerifier
{
    PasswordFormat format = PasswordFormat::None;
    int n = 0;
    int r = 0;
    int p = 0;
    QByteArray salt;
    QByteArray verifier;
    bool isValid = false;
};
 
class PasswordHasher
{
public:
    static QString computeHash(const QString &password, const QString &salt);
    static QString generateRandomSalt(const int len = 16);
    static QString generateActivationToken();

    static QByteArray deriveKey(const QString &password, const QByteArray &salt, int n, int r, int p);
    static bool costParamsAreSane(int n, int r, int p);
    static QString generatePasswordVerifier(const QString &password);
    static PasswordVerifier parsePasswordVerifier(const QString &stored);
    static bool isLegacyFormat(const QString &stored);
    static bool verifyPassword(const QString &password, const QString &storedPasswordData);
    static QByteArray computeResponse(const QByteArray &key, const QByteArray &nonce);
    static bool constantTimeEquals(const QByteArray &a, const QByteArray &b);
};
 
#endif