voidlogic

    package main

    import (
        "crypto/sha1"
        "hash"
        "sync"
    )

    func main() {
        hasher := getHasher()
        defer poolHasher(hasher)
    }

    var hasherPool sync.Pool = sync.Pool{
        New: func() interface{} {
            return sha1.New()
        },
    }

    func getHasher() hash.Hash {
        return hasherPool.Get().(hash.Hash)
    }

    func poolHasher(hasher hash.Hash) {
        hasher.Reset()
        hasherPool.Put(hasher)
    }

  0. Home page
  1. Select product: https://puri.sm/products/
  2. View prod descs, select product: https://puri.sm/products/librem-13/
  3. Scroll down, view prod desc, click shop now
  4. At product configuration page: https://shop.puri.sm/shop/librem-13/

  Client: asks server for nonce
  Server: sends nonce
  ---- OR ----
  Nonce arrives with login page

  Client: sends HMAC(nonce + HMAC(username + password + appname) + Unix Epoch rounded to last 5 min block))

  Server: 
  1. gets response
  2. using username as key pulls HMAC(username + password + appname) from DB
  3. Computes HMAC(last nonce sent to username + DB HMAC + Unix Epoch rounded to last 5 min block)) and compares to user token
  4. last nonce is cleared