discourse/lib/pbkdf2.rb

# frozen_string_literal: true

class Pbkdf2
  def self.hash_password(password, salt, iterations, algorithm = "sha256", length: 32)
    OpenSSL::KDF.pbkdf2_hmac(
      password,
      salt: salt,
      iterations: iterations,
      length: length,
      hash: algorithm,
    ).unpack1("H*")
  end
end
DEV: enable frozen string literal on all files This reduces chances of errors where consumers of strings mutate inputs and reduces memory usage of the app. Test suite passes now, but there may be some stuff left, so we will run a few sites on a branch prior to merging 2019-05-02 17:17:27 -05:00			`# frozen_string_literal: true`

PBKDF2 gem is trouble, removing and hand coding for now 2013-03-06 06:12:16 -06:00			`class Pbkdf2`
PERF: Use `OpenSSL::KDF` for Pbkdf2 implementation (#20982) This was introduced to the standard library in Ruby 2.4. In my testing, it produces the same result, and is around 8x faster than our pure-ruby implementation 2023-04-05 11:00:05 -05:00			`def self.hash_password(password, salt, iterations, algorithm = "sha256", length: 32)`
			`OpenSSL::KDF.pbkdf2_hmac(`
			`password,`
			`salt: salt,`
			`iterations: iterations,`
			`length: length,`
			`hash: algorithm,`
			`).unpack1("H*")`
PBKDF2 gem is trouble, removing and hand coding for now 2013-03-06 06:12:16 -06:00			`end`
			`end`