search

cozy / cozy-stack

Simple, Versatile, Yours
https://docs.cozy.io/en/cozy-stack/
GNU Affero General Public License v3.0
1.11k stars 137 forks source link

Migrate password hashing functions (PBKDF2, Scrypt, etc..) to Argon2id #2519

Open RichardFevrier opened 4 years ago

RichardFevrier commented 4 years ago

Hello everybody 👋 thank you for your amazing work !

I was wondering now that the hashing function Argon2id is available in the official crypto module if it was not the time to migrate the current Cozy's password hashing stack ?

nono commented 4 years ago

I don't think so. Argon2id is known as complicated to correctly tune for the environment (from OWASP) and the current password hashing function is not deprecated or with known vulnerabilities. It would take time to write a migration to Argon2id, and I really think that this time is better use for other purpose.