Atharva Pandey/Lesson 13: Cryptographic Primitives — Hashing, HMAC, and never rolling your own

package main

import (
    "crypto/hmac"
    "crypto/rand"
    "crypto/sha256"
    "encoding/hex"
    "fmt"
    "golang.org/x/crypto/bcrypt"
)

// SHA-256 hash of data — for integrity checking, NOT for passwords
func sha256Hash(data []byte) string {
    h := sha256.Sum256(data)
    return hex.EncodeToString(h[:])
}

// Verify data integrity — did this file arrive without corruption?
func verifyIntegrity(data []byte, expectedHash string) bool {
    actual := sha256Hash(data)
    // Use hmac.Equal for constant-time comparison (prevents timing attacks)
    return hmac.Equal([]byte(actual), []byte(expectedHash))
}

// HMAC-SHA256 — for authenticating messages, signing tokens
func hmacSign(message, secret []byte) string {
    mac := hmac.New(sha256.New, secret)
    mac.Write(message)
    return hex.EncodeToString(mac.Sum(nil))
}

func hmacVerify(message, secret []byte, signature string) bool {
    expected := hmacSign(message, secret)
    // CRITICAL: constant-time comparison to prevent timing attacks
    // strings.Compare or == are NOT safe here
    return hmac.Equal([]byte(expected), []byte(signature))
}

// Generate a cryptographically random secret key
func generateKey(length int) ([]byte, error) {
    key := make([]byte, length)
    if _, err := rand.Read(key); err != nil {
        return nil, fmt.Errorf("generating key: %w", err)
    }
    return key, nil
}

// Password hashing — use bcrypt, not SHA-256
const bcryptCost = 12 // increase with hardware improvements; 10-14 is typical

func hashPassword(plaintext string) (string, error) {
    hash, err := bcrypt.GenerateFromPassword([]byte(plaintext), bcryptCost)
    if err != nil {
        return "", fmt.Errorf("hashing password: %w", err)
    }
    return string(hash), nil
}

func checkPassword(plaintext, hash string) bool {
    err := bcrypt.CompareHashAndPassword([]byte(hash), []byte(plaintext))
    return err == nil
    // bcrypt.CompareHashAndPassword is constant-time
}

// NEVER do this — SHA-256 is reversible with rainbow tables
// and precomputed lookup tables for common passwords
func wrongPasswordHash(pw string) string {
    h := sha256.Sum256([]byte(pw))
    return hex.EncodeToString(h[:])
}

// Webhook sender — sign every delivery
type WebhookSender struct {
    secret []byte
    client *http.Client
}

func (ws *WebhookSender) Send(url string, payload []byte) error {
    sig := hmacSign(payload, ws.secret)

    req, err := http.NewRequest("POST", url, bytes.NewReader(payload))
    if err != nil {
        return fmt.Errorf("creating webhook request: %w", err)
    }
    req.Header.Set("Content-Type", "application/json")
    req.Header.Set("X-Signature-SHA256", "sha256="+sig)
    // Include timestamp to prevent replay attacks
    timestamp := strconv.FormatInt(time.Now().Unix(), 10)
    req.Header.Set("X-Timestamp", timestamp)

    resp, err := ws.client.Do(req)
    if err != nil {
        return fmt.Errorf("sending webhook: %w", err)
    }
    defer resp.Body.Close()
    if resp.StatusCode >= 400 {
        return fmt.Errorf("webhook delivery failed: status %d", resp.StatusCode)
    }
    return nil
}

// Webhook receiver — verify before processing
type WebhookReceiver struct {
    secret        []byte
    maxAgeSeconds int64
}

func (wr *WebhookReceiver) Verify(r *http.Request, body []byte) error {
    // 1. Check timestamp to prevent replay attacks
    tsStr := r.Header.Get("X-Timestamp")
    ts, err := strconv.ParseInt(tsStr, 10, 64)
    if err != nil {
        return fmt.Errorf("missing or invalid timestamp")
    }
    age := time.Now().Unix() - ts
    if age > wr.maxAgeSeconds || age < -60 { // allow 60s clock skew
        return fmt.Errorf("webhook too old or from the future: age=%ds", age)
    }

    // 2. Verify signature
    sigHeader := r.Header.Get("X-Signature-SHA256")
    if !strings.HasPrefix(sigHeader, "sha256=") {
        return fmt.Errorf("missing or malformed signature header")
    }
    received := strings.TrimPrefix(sigHeader, "sha256=")
    expected := hmacSign(body, wr.secret)

    if !hmac.Equal([]byte(expected), []byte(received)) {
        return fmt.Errorf("signature verification failed")
    }
    return nil
}

// Simple API request signing
func signAPIRequest(method, path string, body []byte, secret []byte) string {
    bodyHash := sha256Hash(body)
    timestamp := time.Now().UTC().Format(time.RFC3339)
    // String to sign: deterministic, covers all relevant request fields
    stringToSign := fmt.Sprintf("%s\n%s\n%s\n%s", method, path, timestamp, bodyHash)
    return hmacSign([]byte(stringToSign), secret)
}