antelle / argon2-browser

Argon2 library compiled for browser runtime
https://antelle.net/argon2-browser
MIT License
363 stars 78 forks source link

Verifying secret #63

Closed AltFreq07 closed 3 years ago

AltFreq07 commented 3 years ago

How do I go about using the optional secret data?

The below code works fine for creating the hash, with changing the encodedSecret resulting in a different hash

      const enc = new TextEncoder()
      const encodedSecret = enc.encode(secret)
return argon2.hash({
            pass: inputPassword,
            salt: inputSalt
            time: 1, // the number of iterations
            mem: 128000, // used memory, in KiB
            hashLen: 32, // desired hash length
            parallelism: 1, // desired parallelism (will be computed in parallel only for PNaCl)
            secret: encodedSecret, // optional secret data
            type: argon2.ArgonType.Argon2id, // or argon2.ArgonType.Argon2i or argon2.ArgonType.Argon2id
          })

I can not seem to verify with a secret though and cant find examples.

    const enc = new TextEncoder()
      const encodedSecret = enc.encode(secret)
      return argon2.verify({
        pass: inputPassword,
        encoded: encodedHash,
        secret: encodedSecret,
      })

Seems if I remove the secret from the hash function the verify will work even with the secret argument set which leads me to believe secret is either not implemented or called something other than secret in the verify function.

antelle commented 3 years ago

Thanks! Added secret: https://github.com/antelle/argon2-browser/blob/master/test/suite/verify.js#L130-L137