Hash used for pre-hashing should be configurable. Default to SHA-3.
e.g. Use hash.Hash and sha3.New512() (each hash sum call will either need to lock and reset the hash.Hash OR create a new hash.Hash)
Note: As of 2017-01-07, the Golang implementation chose to only expose Argon2i which is optimized for password hashing and KDFs since it's data independent. See:
How to run Passhash code.Everytime I run this happens
user@Hal:~/go/src/passhash$ go run doc.go
go run: cannot run non-main package
user@Hal:~/go/src/passhash$ go run audit_logger.go
go run: cannot run non-main package
user@Hal:~/go/src/passhash$ go run passhash.go
go run: cannot run non-main package
Not having a limit opens the door for a DoS attack if an organization has many password policies and an attacker crafts a password that fails them all. e.g. potentially unbounded memory allocated