search

alexedwards / argon2id

Argon2id password hashing and verification for Go
MIT License
452 stars 44 forks source link

DecodeHash must check if hashed password uses argon2id #13

Closed constb closed 2 years ago

constb commented 2 years ago

DecodeHash goes straight to decoding argon2id params without checking first if vals[1] == "argon2id". I think this check is required and a meaningful error must be returned if wrong hash type is provided.

alexedwards commented 2 years ago

Good spot, thanks. I've pushed commit b3bf4bb8cbbf75de9aa4cc45382e7356611204af which now returns an ErrIncompatibleVariant error if the hash uses a variant that isn't equal to argon2id