-
Notifications
You must be signed in to change notification settings - Fork 30
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Argon2id binding #24
Comments
Definitely a good idea. Give me a bit of time to work through this. |
Plot twist: The reference C library has no tests for Argon 2id. Let me get a PR for that first. |
@MidnightWonderer Just updating to note I've sent P-H-C/phc-winner-argon2#261 in to address the upstream issue, waiting on merge or feedback. |
@midnight-wonderer Thanks for your patience with this. As you may have seen, my PR has been taken upstream. I've pushed some commits to integrate support for 2id in our C bindings, and I'll be integrating verify support soon. Changing the actual default will take a major version bump, but we'll get there. |
Thanks for all the updates @technion 👍 I'm excited to see this as well (and may make it the default for blind index in the future). |
@ankane are you planning to upgrade from argon2i to argon2id for your indexes? |
@midnight-wonderer Planning to add a new algorithm type for it (to mirror CipherSweet blind indexes). What are you thinking? |
I have tagged v1.2.0 which now supports verifying Argon2id hashes. I will shift the default in master shortly but I'll take my time with tagging 2.0 and ensure it's correct. |
Thanks @technion 💯 Are there plans to add support for creating Argon2id hashes ( |
@ankane I think that changing the algorithm would have the same result as changing salt (or key). This will be a bit off topic but just my 2 cents: |
I appreciate the feedback.
|
@ankane absolutely, I'll be making Argon2id the default in 2.0. |
Update: master now hashes to Argon2_id, whilst maintaining full backward compat. This feature needs better tests before its'fully baked. |
@technion Awesome! I think it'd be good to have a separate function like |
@ankane I've had a goal here of not giving someone enough rope to hang themselves. I certainly appreciate the need to support verifying all formats, but I can refer to the amount of in production code I've been told apparently uses the _salt_do_not_supply parameter in describing why just following current best practice is a better proposal. Edit: To be clear though, this is a change that will necessitate a v2.0 version, and I'll keep 1.x supported as long as feasible. So if this matters, there is that option. |
I completely agree that cryptography libraries should be designed to be hard to misuse, but don't think this falls into that category. Regardless, thanks for adding Argon2id support 🎉 |
I'll close this off as master has covered everything I believe is necessary. I'll tag 2.0 shortly for release. |
Quote from the IETF draft.
https://tools.ietf.org/html/draft-irtf-cfrg-argon2-03#section-9.4
I wonder if we can get the variant to be the default of
ruby-argon2
too?The text was updated successfully, but these errors were encountered: