This site says how to encrypt data using a password in go using AES-GCM.
It says the following:
When encrypting and decrypting data, it is important that you are using a 32 character, or 32 byte key. Being realistic, you’re probably going to want to use a passphrase and that passphrase will never be 32 characters in length.
To get around this, you can actually hash your passphrase using a hashing algorithm that produces 32 byte hashes. I found a list of hashing algorithms on Wikipedia that provide output lengths. We’re going to be using a simple MD5 hash. It is insecure, but it doesn’t really matter since we won’t be storing the output.
Is this true?
So fine, I don't mind using something a bit more secure than MD5, it's easy to replace MD5 with SHA-2.
But another thing hit me:
- Why is something like bcypt/scrypt not required?
- Is AES slow enough to prevent a brute-force attack?