udeServer/internal/logic/keygen.go

package logic

import (
	"crypto/pbkdf2"
	"crypto/rand"
	"crypto/sha256"
	"encoding/hex"
	"fmt"
	"strings"

	"github.com/google/uuid"
)

const (
	keyKDFIterations = 100_000
	keyContentBytes  = 32

	keyStatusEnabled  = "1"
	keyStatusDisabled = "2"

	keyDefaultStatus = keyStatusEnabled
)

// newKeyIden returns a UUIDv4 string without dashes.
func newKeyIden() string {
	return strings.ReplaceAll(uuid.NewString(), "-", "")
}

// deriveKeyContent derives a 256-bit key with PBKDF2-HMAC-SHA256.
// The password is a fresh random seed and iden is the salt, so every
// key record gets an unpredictable content.
func deriveKeyContent(iden string) (string, error) {
	seed := make([]byte, 32)
	if _, err := rand.Read(seed); err != nil {
		return "", fmt.Errorf("generate random seed: %w", err)
	}

	derived, err := pbkdf2.Key(sha256.New, string(seed), []byte(iden), keyKDFIterations, keyContentBytes)
	if err != nil {
		return "", fmt.Errorf("derive key content: %w", err)
	}

	return hex.EncodeToString(derived), nil
}