How to use keyed hashing?

[thusoy]

I'm struggling to figure out how to use the keyed hashing that argon2 provides, any hints? Can't find any mentions of it in the docs, only thing I can find is the ffi declaration. How can this be set from python?

[thusoy]

Or rather, I found this reference to it, but doesn't seem to have first-class support since it's hidden away in the hazmat section. Any plans to make a high-level interface to keyed hashing?

[hynek]

I’m afraid the Argon2 ref implementation I’m wrapping never made this stuff part of their…let’s call it “user APIs” and I’m not comfortable to implement it using core and context myself.

But cases like these are the reason why I’m exposing those very low-level structures at all.

[thusoy]

Hmm, yeah, I can see that it's classified as "low-level API" in the reference code. But I think it should be Fairly Easy(tm) to use context's when using the PasswordHasher interface, since that is practically a python-level context you're keeping around anyway, and would expose a very useful feature to a wider audience. Would you accept a PR that made PasswordHasher use the low-level argon APIs to expose this, or would you prefer that this is done elsewhere using the core stuff you already expose?

[thusoy]

@hynek For what it's worth, I wrote a proof-of-concept implementation of PasswordHasher that wraps the context and core functions here. Since this library doesn't guarantee any stability of the low-level interface it's also impossible to publish this in a separate package that depends on this library without constantly releasing new versions in lock-step, which sounds like a nice bowl of pain. If this is cleaned up and tests added, would you accept a PR replacing the implementation of the current PasswordHasher?

[hynek]

I appreciate your effort but at this point I’m not comfortable to both implement these things ourselves and frankly to use such half-public functions from Argon2’s API. I just don’t trust them too much.

My suggestion: try to convince the Argon2 authors to promote keyed hashing into their public APIs and I’ll add it to argon2_cffi happily.

As for the stability of the low-level interface: it’s not really that I don’t guarantee it: it’s just that I have to follow the Argon2 lib interfaces. I change as little as I can.

[thusoy]

Fair enough, thanks. I'll put this in another lib then, I wouldn't think the interface to argon2_core would change much since it's used by practically everything, but if that turns out to be the case I'll reevaluate how to approach this.