Skip to content

password-hash: change bounds for PHC verify blanket impl [BREAKING]#2370

Merged
tarcieri merged 1 commit intomasterfrom
password-hash/phc-verify-params-from-hash
Apr 7, 2026
Merged

password-hash: change bounds for PHC verify blanket impl [BREAKING]#2370
tarcieri merged 1 commit intomasterfrom
password-hash/phc-verify-params-from-hash

Conversation

@tarcieri
Copy link
Copy Markdown
Member

@tarcieri tarcieri commented Apr 7, 2026

Changes the TryFrom bound for constructing T::Params to accept a full phc::PasswordHash as the input type, rather than just its phc::ParamsString.

This is actually how it used to work in prior releases, but regressed:

https://docs.rs/password-hash/0.5.0/src/password_hash/traits.rs.html#63

This is needed so the params can include the output size for the hash.

This is unfortunately a breaking change, but fortunately we haven't yet released any password hash crates, so it will only impact prerelease users.

Closes #2352.

Changes the `TryFrom` bound for constructing `T::Params` to accept a
full `phc::PasswordHash` as the input type, rather than just its
`phc::ParamsString`.

This is actually how it used to work in prior releases, but regressed:

https://docs.rs/password-hash/0.5.0/src/password_hash/traits.rs.html#63

This is needed so the params can include the output size for the hash.

This is unfortunately a breaking change, but fortunately we haven't yet
released any password hash crates, so it will only impact prerelease
users.
@tarcieri tarcieri force-pushed the password-hash/phc-verify-params-from-hash branch from 14f1c89 to 67781ec Compare April 7, 2026 20:09
@tarcieri
Copy link
Copy Markdown
Member Author

tarcieri commented Apr 7, 2026

I'll open a corresponding PR to https://github.com/RustCrypto/password-hashes first before merging

@tarcieri
Copy link
Copy Markdown
Member Author

tarcieri commented Apr 7, 2026

Hah, so as it were all of our crates have the impls needed to make this work since they had them from before. It's technically non-breaking from the perspective of our crates.

I'm going to go ahead and merge this and do a release (after verifying it actually resolves #2352 with a test). But we should probably yank v0.6.0 since it is technically a breaking change.

@tarcieri tarcieri merged commit 2501d4f into master Apr 7, 2026
12 checks passed
@tarcieri tarcieri deleted the password-hash/phc-verify-params-from-hash branch April 7, 2026 20:23
tarcieri added a commit to RustCrypto/password-hashes that referenced this pull request Apr 7, 2026
This adds a test that non-default output lengths are correctly supported
which was implemented in RustCrypto/traits#2370
tarcieri added a commit to RustCrypto/password-hashes that referenced this pull request Apr 7, 2026
This adds a test that non-default output lengths are correctly supported
which was implemented in RustCrypto/traits#2370
@tarcieri tarcieri mentioned this pull request Apr 7, 2026
tarcieri added a commit that referenced this pull request Apr 8, 2026
## Changed
- [BREAKING] `PasswordVerifier` blanket impl bounds for `phc::PasswordHash` (#2370)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

password-hash 0.6 Argon2 verification fails for PHC hashes with non-default output lengths

1 participant