Plans to add Argon2 as a password hashing backend?

[dougthor42]

Are there any plans to add the new Argon2 password hashing function?

Django is already starting to consider it and there are already ctypes and CFFI bindings for it.

A little more info: https://hynek.me/articles/storing-passwords/

[alex]

Probably not until it's supported in a widely used backend (e.g. OpenSSL). @hynek (who wrote argon2-cffi) is also a contributor here :-)

[dougthor42]

Oh cool, and I just read his article. How nifty.

Anyway, I don't have any need for it; just curious.

[alex]

This is further complicated that the argon2 spec is changing to address some weaknesses found.

[reaperhulk]

I'm going to go ahead and close this since we're mostly dependent on OpenSSL for this.

[amirouche]

Any news regarding this?

[alex]

No change. For now if you want argon2 you should use argon2_cffi.

[maqp]

I hope Argon can be added soon to this library. That could mean that by Bionic, Ubuntu would come pre-installed with ideal suite of primitives for crypto applications; X25519, ChaCha20-Poly1305 and Argon2.

[reaperhulk]

This is entirely dependent on OpenSSL adding argon2(id). Since scrypt is now available in OpenSSL maybe argon2(id) could be added, but I'm not aware of any proposal to do so at this point.