@@ -3,9 +3,8 @@ package encryption
33import (
44 "crypto/hmac"
55 "crypto/rand"
6+ "crypto/sha256"
67 "encoding/base64"
7−
8− "golang.org/x/crypto/blake2b"
98)
109
1110// Nonce generates a random n-byte slice
@@ -18,16 +17,16 @@ func Nonce(length int) ([]byte, error) {
1817 return b, nil
1918}
2019
21−// HashNonce returns the BLAKE2b 256-bit hash of a nonce
22−// NOTE: Error checking (G104) is purposefully skipped:
23−// - `blake2b.New256` has no error path with a nil signing key
24−// - `hash.Hash` interface's `Write` has an error signature, but
25−// `blake2b.digest.Write` does not use it.
26−/* #nosec G104 */
20+// HashNonce returns the SHA256 hash of a nonce
2721func HashNonce(nonce []byte) string {
28− hasher, _ := blake2b.New256(nil)
22+ if nonce == nil {
23+ return ""
24+ }
25+
26+ hasher := sha256.New()
2927 hasher.Write(nonce)
3028 sum := hasher.Sum(nil)
29+
3130 return base64.RawURLEncoding.EncodeToString(sum)
3231}
3332