bcmyers / argonautica

Idiomatic argon2 password hashing for several languages
Apache License 2.0
146 stars 29 forks source link

Same input gives different hashes if it's run in docker #18

Closed little-dude closed 5 years ago

little-dude commented 5 years ago

Hello,

I have the following piece of code:

fn main() {
    let hash = argonautica::Hasher::default()
        .with_password("qwerty123")
        .with_secret_key("my_secret_that_must_be_at_least_thirty_two_bytes_long")
        .hash()
        .unwrap();
    println!("{}", hash);
}

I noticed that it prints different results when running in different environments. For instance on my machine it prints:

$argon2id$v=19$m=4096,t=192,p=8$EvpazrlY0ApjLxAXz/Xgv301w1BVvpf8iACX57If9/I$uQFyf1OfHwfuoNNt4RwR1p9Esbtqh8mfPY8B66N9rLY

But when I run it in a docker container I get

$argon2id$v=19$m=4096,t=192,p=8$na6G3tOLyjQOZLfQkNFPJagLKzNkCX1sTtn0L9TJN0s$8C0R7jRHbUrck67r0wneJxG2g2U1phUW1ObK1UNd+eY

I thought that given the same secret and input, the hash function would give the same output. Am I misunderstanding something about how to use this library?

If you need to reproduce, I set up a repo here: https://github.com/little-dude/argonautica-issue.

little-dude commented 5 years ago

Oh so this is actually due to the random salt being used. Sorry for not reading the docs more carefully.