Password hashing example

[bkmgit]

The demo UI form has an example of an input password:

• https://github.com/part-cw/lambdanative/blob/master/apps/DemoUIForm/main.scm#L59-L60

At present it is stored in the UI, but often password hashes are saved in a database, for example

• lambdanative/modules/uiform/uiform.scm

  Line 920 in 4bd7958

  (strhash (string-append "DM" (number->string (string=?-hash str))))

• https://github.com/part-cw/LNhealth/blob/f46e09719c267bd0f6bd21a295adeacf5f1dda74/apps/PARA/sandbox/main.sx#L750

The above use srfi69, but LambdaNative has bindings to

• OpenSSL
• Nacl
• p256ecdsa which has been removed from Android

Would it be helpful to have examples of password hashing using one of these libraries?

[mgorges]

We have secure hash functions to be applied to files already implemented, such as (sha256sum filename), (sha512sum filename), and (sha1sum filename) all of which can be found in modules/timestamp/shasum.scm#L39, these are C bindings into OpenSSL's <openssl/sha.h> Additionally, we use blowfish in modules/rupi/u8vector-blowfish.scm#L62 for vector encryption, which uses C bindings into OpenSSL's <openssl/blowfish.h>.
Expanding this to run hashes of strings should be relatively straightforward, though the selection of a good seed might need some consideration. Maybe just a call to RAND_bytes and PKCS5_PBKDF2_HMAC, with EVP_sha256() or something like it?