Change argon2 salt length to recommended value (16 bytes)

[falko17]

This pull request changes the Ksf implementation for Argon2 and sets the salt length to 16 bytes (instead of the minimal length of 8 bytes), the value recommended for password hashing in section 3.1 of the Argon2 specification.
This also serves to improve interoperability: for example, with this change, it's possible to use opaque-ke in conjunction with libopaque, since it also uses a 16-byte salt by default.

Note that this will make existing registrations (i.e., those made with an 8-byte salt) invalid, since KSF parameters (including salt length) must stay the same across registration and login.

[kevinlewi]

Given RustCrypto/password-hashes#306, perhaps it would be more apt to use the constant newly-exported constant RECOMMENDED_SALT_LEN?

[falko17]

I agree it would be cleaner to use that, but the constant is unfortunately only visible when the password-hash feature is enabled, which would add the corresponding crate as a transitive dependency. Apart from that, the PR containing the constant was just merged yesterday, so it isn't in the published crate yet.

[daxpedda]

As far as I know, the only reason we are using a salt at all, is because it's required. After all, we are using a static salt, so it's security value is zero. So following the recommendation doesn't make straightforward sense to me. Specifically, the minimum amount was used because it's the minimum required.

Of course, the issue, as pointed out by @falko17, is compatibility, we all have to somehow agree on the same salt to be compatible with each other.

@kevinlewi can this be coordinated by the spec somehow? Maybe go a bit further and specify a static salt for MHFs, instead of using zeroes?

[daxpedda]

I just submitted RustCrypto/password-hashes#307 for us. The RustCrypto team is quite quick with releasing new versions on demand.

Despite my comment before, I think the PR is still fine, we can follow-up afterwards.

[kevinlewi]

It's outside the purview of the OPAQUE spec to specify the length of the salt for the key stretching function (argon in this case).

Agreed, pending the outcome of that PR, we can follow up afterwards. Thanks for working on this @falko17, this should be good to merge.

[kevinlewi]

Just need to add feature-gating for argon2

[falko17]

Thanks for your comments! Should we wait until the changes from RustCrypto/password-hashes#306 and RustCrypto/password-hashes#307 are released in a new crate version so that the constant can be used, or do we want to address this later in a follow-up PR? I'm not sure how long this will take, so perhaps addressing this in a follow-up is the better option here.

[kevinlewi]

Agreed, we can land now. Thanks for contributing!