# README

Simple Password-Hardened Encryption Services

Virgil Security introduces an implementation of the Password-Hardened Encryption (PHE) protocol that provides developers with a technology to protect users passwords from offline attacks and make stolen passwords useless even if your database has been compromised.

PHE is a new, more secure mechanism that protects user passwords and lessens the security risks associated with weak passwords. Neither Virgil nor attackers know anything about user's password.

Authors: Russell W. F. Lai, Christoph Egger, Manuel Reinert, Sherman S. M. Chow, Matteo Maffei and Dominique Schroder

WhitePaper: https://virgilsecurity.com/wp-content/uploads/2018/11/PHE-Whitepaper-2018.pdf

Go implementation by Alexey Ermishkin VirgilSecurty.com.

# Packages

swu

No description provided by the author

# Functions

Decrypt

Decrypt extracts 32 byte salt, derives key & nonce and decrypts ciphertext.

Encrypt

Encrypt generates 32 byte salt, uses master key & salt to generate per-data key & nonce with the help of HKDF Salt is concatenated to the ciphertext.

GenerateClientKey

GenerateClientKey creates a new random key used on the Client side.

GenerateServerKeypair

GenerateServerKeypair creates a new random Nist p-256 keypair.

GetEnrollment

GetEnrollment generates a new random enrollment record and a proof.

GetPublicKey

GetPublicKey returns server public key.

NewClient

NewClient creates new client instance using client's private key and server's public key used for verification.

PointUnmarshal

PointUnmarshal validates & converts byte array to an elliptic curve point object.

Rotate

Rotate updates server's private and public keys and issues an update token for use on client's side.

RotateClientKeys

RotateClientKeys returns a new pair of keys given old keys and an update token.

UpdateRecord

UpdateRecord needs to be applied to every database record to correspond to new private and public keys.

VerifyPassword

VerifyPassword compares password attempt to the one server would calculate itself using its private key and returns a zero knowledge proof of ether success or failure.

VerifyPasswordExtended

VerifyPasswordExtended compares password attempt to the one server would calculate itself using its private key and returns a zero knowledge proof of ether success or failure and an object containing verify result & salt used for verification.